UNION SQLi: get column count right or go home

ORDER BY probing, type alignment, and marker placement for reflective UNION. The Repeater sequence I still run by hand.

Published Updated 2 min read
sqliunionchecklist

UNION is the fastest exfil path when the backend query lands in HTML. It is also the fastest way to prove you skipped homework.

UNION SELECT 1,2,3 against a seven-column SELECT does not mean "not injectable." It means you did not run ORDER BY yet. I have watched that happen in pentest reports that later got torn apart in remediation review.

The crafter Exploitation step emits UNION templates per DBMS. Strings are pre-built. The sequence below is what I still click through manually in Repeater.

ORDER BY until it breaks

String context, dash comment style:

' ORDER BY 1-- 
' ORDER BY 2-- 
...
' ORDER BY 7--   → 500 or error page
' ORDER BY 6--   → 200, normal page

Six columns. Your UNION needs six expressions. Off-by-one is the most common false negative in notes I review.

MySQL tolerates UNION ALL SELECT null,null,null,null,null,null for type probing. SQL Server will throw conversion errors if you park a string in an int slot even when injection works. I swap one position at a time to version() or @@version and watch which column complains.

Find the column that actually renders

Not every SELECT list item hits the template. Unique marker per position:

' UNION ALL SELECT null,'sqli-mark-3',null,null,null,null--

Only the fragment visible in the response body matters for exfil. I have burned twenty minutes pulling data into column 4 when column 2 was the only one wired to the page.

Zero columns reflect? You might still be in UNION-eligible SQL feeding JSON or a PDF generator. For this HTTP response you are probably in blind territory.

One proof field, then stop

version() or database() in the reflecting slot. Screenshot. Move on unless the scope letter explicitly allows schema enumeration.

information_schema walks and sys.tables queries spike volume on WAF dashboards. Clients remember the part of the report where you tripped rate limiting. Throttle. LIMIT 1. One table name beats a dump that got your IP soft-banned.

When UNION keywords die

UN/**/ION and case folding slip past naive filters sometimes. Enable one transform from the crafter, retest, document the minimum that worked. If the body is byte-identical for every UNION variant and errors are generic, stop. Stacked queries, second-order sinks, or boolean inference might be the actual game.

UNION is not a moral failure. Wrong tool for that response shape.

FAQ

Do I always need ORDER BY before UNION?
On reflective UNION, yes. ORDER BY n until error gives column count. Guessing arity is how you get a loud syntax error and a helpdesk ticket.
Why does UNION ALL sometimes work when UNION fails?
Some apps dedupe UNION output. UNION ALL skips distinct logic. Try it when rows look truncated or you only see one of two injected result sets.
When should I stop trying UNION?
No reflection, INSERT/UPDATE sink only, or identical bodies for every UNION probe. Pivot to boolean blind or error-based if errors leak.

Related articles