Including static values in SQL query

Question

I'm testing SQL injection in my lab and need to combine two SQL queries using UNION to bypass authentication, so I would like to know if there is a way to set static values in second query, so that my JAVA code will check will only check for the user password I send as static password : The SQL Query should be like this :

 SELECT * FROM users WHERE user = 'user1' UNION SELECT user AS 
 user1, password AS password FROM users ;'

My JAVA code reports an error :

 You have an error in your SQL syntax; check the manual that 
 corresponds to your MySQL server version for the right syntax to 
 use near

Remove the semicolon?

The Impaler
– The Impaler

2018-12-19 20:04:53 +00:00
Commented Dec 19, 2018 at 20:04 — The Impaler
– The Impaler, Commented Dec 19, 2018 at 20:04

Joe Stefanelli · Accepted Answer · 2018-12-19 20:06:15Z

3

First, eliminate the use of SELECT * to make sure both queries return the same number of columns. Then you can hard code your static values in the second query.

SELECT user, password
    FROM users
    WHERE user =  'user1'
UNION
SELECT 'user', 'password';

answered Dec 19, 2018 at 20:06

Joe Stefanelli

136k21 gold badges243 silver badges241 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Aziz Azizos Over a year ago

Theorically I have no control on the first query so I can't change it, in this case I think I can ad NULL values to match the first queries size. ` SELECT * FROM users WHERE user = 'user1' UNION SELECT 'user', 'password', 'Null', 'null'; `

Joe Stefanelli Over a year ago

@AzizAzizos Yes, you can add NULLs to the second query to match the number of columns returned by the first, but do not enclose them in single quotes. If you do, you'll get the literal string 'NULL' instead of a true NULL value.

ScaisEdge · Accepted Answer · 2018-12-19 20:20:26Z

2

Using union
You must select the corresponding number type of column eg:

 SELECT user, password
 FROM users 
 WHERE user = 'user1' 
 UNION 
 SELECT 'user', 'password' 
  ;

edited Dec 19, 2018 at 20:20

answered Dec 19, 2018 at 20:04

ScaisEdge

133k10 gold badges98 silver badges111 bronze badges

3 Comments

The Impaler Over a year ago

Probably, the query after the UNION is the one that should be modified (that's the one injected). Anyway, I think it's a good answer.

Aziz Azizos Over a year ago

The second query should be static (Hard coded), I don't want the code to grab anything from the database

Joe Stefanelli Over a year ago

The second query will return one row of 'user', 'password' for every row in the users table. UNION will, of course, then eliminate the duplicates, but it's still kind of silly and inefficient to do.

Collectives™ on Stack Overflow

Including static values in SQL query

2 Answers 2

2 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related