MySQL injection (Step2) - How to find Vuln Column Using Union Method

HOW TO FIND VULN COLUMN TUT PART-3
----------------------------------------------------

‪RECALL - in 1st post we learn to find vuln site?

RECALL - in second post we learn to find how many column are there order by methOd

‪Next stEp now we will find vuln site vuln column don't be confuse that 2times same method?
 yeah there is two step to find vuln column it mean 1st you have to find how many column are there in site and to make sure that there is how many column we need to use this "union select" methOd

1st post- click here

2nd post- click here

site- we will practise in this site
http://www.skitm.edu.in/faculty.php?id=2

All step wise 1st we learn how to find either it is vuln or not yeah?
Here we use method like this

http://www.skitm.edu.in/faculty.php?id=2'

getting sql error yeah? It mean this site is vuln.

‪#‎2nd‬ post
in second step what we learn? we learn how to find vuln column? Like this

 http://www.skitm.edu.in/faculty.php?id=2 order by 3

‪#‎3rd‬ step is that to find vuln column both are column but to find vuln column result in screen we need order by to get result in screen like shown in screenShOt,

Here we go in step now

 1) do you remember or not while we inject this site we got last error in 3 yeah? It mean here is 2 column now to display how many vuln column are there in screen we have to use following query

 http://www.skitm.edu.in/faculty.php?id=-2 union select 1,2--

What i have change in this site?

=> after id=parameter i haven't change there anything but i have put there sign '-' while using union select always remember to put that sign before parametEr..
how we will know that we have to put union select 1,2?

=> we have to use 1st order by method after knowing column vuln we have tO use according to vuln column value in union select..

example-
site- http://www.calidus.ro/
vuln site http://www.calidus.ro/en/news.php?id=2
To check the vuln column value in screen you will get some number in screen like 1,2,3 only one digit

Another example
http://www.calidus.ro/en/news.php…

i got last error in 5 so i know now there is vuln in 4 so i use union select 1.2,3,4 and in screen i get vuln is column 2

‪#‎remember‬ that when you use order by method and get vuln column according to it's value put it in union select

Hope you understand
 ‪#‎feel free to ask help
Post challenge about only finding vuln column now it will help to learn easily
‪