'ORDER BY' Doesn't work? Look here [String Based Tutorial]

So you have find a vulnerable site but when you do 'order by 1000000--' it doesn't work?

This is probably due to the fact that you will have to use String Based Injection. I am going to show you how to do that. :)

First lets say you have this website which gave you SQL Error.

Code:

[You must be registered and logged in to see this link.]

You try the regular command:

Code:

[You must be registered and logged in to see this link.]

Hm.. Still no Error. Now it's time to use String Based Injection.

You try this new command

Code:

[You must be registered and logged in to see this link.]

Now you will still have no error, and you then use this command:

Code:

[You must be registered and logged in to see this link.]

ERROR ! Finaly, so now it's just like regular injection, lets say we try:

Code:

[You must be registered and logged in to see this link.]

Which gives us an error and then we try:

Code:

[You must be registered and logged in to see this link.]

And that query gives us no Error. Then you just do it like normal injection:

Code:

[You must be registered and logged in to see this link.]

Now we have just performed a String Based SQL Injection. :)


NOTE: I wrote this tutorial very quick so there is a possibility there are typos and stuff like that. Feel free to point them out for me.

Nice info.