Error-based SQL Injection

When an application prints raw database errors, you can trick the database into putting the data you want inside the error text. It is slower than UNION but works in spots where there is no reflected column, as long as errors are visible.

When the app leaks DB errors

First confirm the errors actually reach you. Break the query with a quote and look at the response. If you see a real database message (You have an error in your SQL syntax, ORA-00933, Conversion failed), error-based is on the table. If you get a clean generic page, the data channel is closed and you should go blind.

Forcing data into an error message

The trick is a function that fails when handed your subquery's result, and that includes the offending value in its complaint. You wrap your SELECT so its output becomes part of the error string.

XPath tricks on MySQL

extractvalue and updatexml parse an XPath expression and error on a malformed one, printing the bad input. Feed them your data prefixed with 0x7e (a ~) to force a malformed path:

' AND extractvalue(1,concat(0x7e,(SELECT @@version)))-- -
' AND updatexml(1,concat(0x7e,(SELECT user())),1)-- -

The version or current user appears right there in the XPATH syntax error message. Swap the inner SELECT for table names, columns, or a credential and repeat.

CAST and conversion errors on MSSQL and Postgres

Where there is no XPath function, a type conversion does the same job. Convert your string result to an integer and the failure prints the string:

MSSQL:    ' AND 1=CONVERT(int,(SELECT @@version))-- -
Postgres: ' AND 1=CAST((SELECT version()) AS int)-- -

The database cannot turn the version string into an int, so it reports the value it choked on.

When errors are suppressed, go blind

Error-based depends entirely on the message reaching you. Many apps catch exceptions and return a generic page in production. The moment you lose the error text, switch to boolean or time-based blind, which need no visible output at all.

Practice spotting and squeezing errors on a free live target.