Hi people, I have been having trouble with union injection that just hangs then a time out. The ’ ORDER BY works fine but when it come to injecting with the UNION it just hangs, i have tried
’ UNION select 1,2,3,4-- -
’ UNION select NULL,NULL,NULL,NULL-- -
’ UNION select a,b,c,d-- - but all i get is a time out. Am i doing something?
Thanks
Hey! You aren’t actually putting the third - in there right?
’ UNION select 1,2,3,4--
Should show numbers in each row. The third - represents the whitespace at the end. Just wanted to make sure you weren’t, because that would probably mess it up!
-onthesauce
Thanks for the reply onthesause. yea i tried without the third - . i have tried changing the comment with # and /**/ . I have also tried url encoding but same response both in the search bar and address bar. It works for the order by but for some reason not the union. Could it be firefox that’s the problem?
Hi, I don’t know if you figured it out.
But remember the – - (the last is a SPACE) and in URL in Firefox you need to add ‘+’ to represent a space. Then it should work. Or you you can use the input box and just end your – with a space. Hope this solves it for you.
So something like this cn%27%20UNION%20select%201,2,3,4–+
Hi, the problem i have been have is with firefox. Everything is ok when using the pwnbox. But using my own box with vpn, firefox for some reason just hangs. I think it might have something to do with a setting in the about:config. The ORDER BY works no problem, but the UNION gives me problem’s.
Not sure if this is still an issue. In case it is, URL encoding the string helped me work around the issue of Firefox hanging.