[sec0verun]

a union select occurs when you join an arbitrary query together with the original query but datatypes must match you can use null but if your clueless as to why you see numbers pop up when you do it i can tell you a number output means its injectable to return data via a visible union injection



a marker if your using a tool like pynject like i use you would do this


order by ...

union all select ...4,5,6,7,@@version--



if the version outputs you do this



pynject -u ' http://www.site.com/test/test.php?id=union all select ...4,5,6,7,####--' -m '####' --dbs


not sure if syntax is right im not using backbox im on winblowz ill fix if its wrong when i boot later

but the point is pynject uses a visible union select meaning it has to output to the page

once this stage is complete you can play

but fucked up thing is pynject doesnt seem to work without information schema so 4 is out the question due to having to bruteforce i think i will research this though maybe if you already know info from a blind or other method and you have a union than your great i would assume you could just feed it the info without it querying not sure though

give it a try i like the methods in this tool but prefer by hand :mad: