MySQL injection - how to use union method (basics)

‪
‪OLD LESSONS - in 1st post we learn to find vuln site?

In second post we learn to find how many column are there order by methOd
‪

BEGIN IT NOW

now we will find vuln site vuln column don't be confusethat 2times same method!yeah there is two step to find vuln column it mean 1st you have to find how many column are there in site and to make sure that there is how many column we need to use this "union select" methOd

site- we will practise in this site

http://www.skitm.edu.in/faculty.php?id=2

All step wise 1st we learn how to find either it is vuln or not yeah?

Here we use method like this
 http://www.skitm.edu.in/faculty.php?id=2'

getting sql error yeah? It mean this site is vuln.
‪old post
in second step what we learn? we learn how to find vuln column?

Like this http://www.skitm.edu.in/faculty.php?id=2 order by 3

next step is that to find vuln column both are column but to find vuln column result in screen we need order by to get result in screen!
Here we go in step now

1) do you remember or not while we inject this site we got last error in 3 yeah? It mean here is 2 column now to display how many vuln column are there in screen we have to use following query

http://www.skitm.edu.in/faculty.php?id=-2 union select 1,2--

now how to get tht which number of column is vulnerable?

allways remember when you put tht union query u got the HIGHLIGHTED OR BOLD NUMBER OF VULN COLUMN AS DIGIT! now your job is identified it! by your self use your buttons i mean eyes lol :3 

What i have change in this site?

=> after id=parameter i haven't change there anything but i have put there sign '-' while using union select always remember to put that sign before parametEr..

how we will know that we have to put union select 1,2?

=> we have to use 1st order by method after knowing column vuln we have tO use according to vuln column value in union select..

example-

our target site :

 http://www.calidus.ro/

vuln site 

http://www.calidus.ro/en/news.php?id=2

To check the vuln column value in screen you will get some number in screen like 1,2,3 only one digit
Another example

http://www.calidus.ro/en/news.php?id=-2%20union%20select%201,2,3,4

i got last error in 5 so i know now there is vuln in 4 so i use union select 1.2,3,4 and in screen i get vuln is column 2

‬ please remember that when you use order by method and get vuln column according to it's value put it in union select

Hope you understand
‪feel free to ask help!
Post challenge about only finding vuln column nowit will help to learn easily

Regard : Cyber Ninja