Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The boundary between ORDER BY 3 and ORDER BY 4 fixes the original query width: oRDER BY 3 succeeds, ORDER BY 4 fails, and UNION SELECT null,null,null adds the required all-null row. A three-null UNION independently confirms that shape.

Lab objective/setup

Exercise SQL injection UNION attack, determining the number of columns returned by the query through the endpoint and input recorded in the lab note. ORDER BY 3 succeeds, ORDER BY 4 fails, and UNION SELECT null,null,null adds the required all-null row.

What I observed

ORDER BY 3 succeeds, ORDER BY 4 fails, and UNION SELECT null,null,null adds the required all-null row.

The first `category` sequence finds the boundary: `ORDER BY 3` returns products, while `ORDER BY 4` produces an error.
The first `category` sequence finds the boundary: `ORDER BY 3` returns products, while `ORDER BY 4` produces an error.
`ORDER BY 3` succeeds, `ORDER BY 4` fails, and `UNION SELECT null,null,null` adds the required all-null row.
`ORDER BY 3` succeeds, `ORDER BY 4` fails, and `UNION SELECT null,null,null` adds the required all-null row.

Why it is vulnerable

ORDER BY 3 succeeds, ORDER BY 4 fails, and UNION SELECT null,null,null adds the required all-null row. The application passes that value into the security-sensitive operation without the context-specific validation or encoding needed to prevent this result.

Walkthrough in the authorized PortSwigger lab

Increment the ORDER BY index until the response changes from success to error, recording three as the last valid position. Then issue UNION SELECT null,null,null to prove that a three-column row is accepted.

Increment the `ORDER BY` index until the response changes from success to error, recording three as the last valid position. Then issue `UNION SELECT null,null,null` to prove that a three-column row is accepted.
Increment the `ORDER BY` index until the response changes from success to error, recording three as the last valid position. Then issue `UNION SELECT null,null,null` to prove that a three-column row is accepted.
ORDER BY 4 produces the visible Internal Server Error after ORDER BY 3 succeeded, fixing the original query width at three columns.
ORDER BY 4 produces the visible Internal Server Error after ORDER BY 3 succeeded, fixing the original query width at three columns.
The category parameter accepts UNION SELECT NULL,NULL,NULL and the normal product listing returns, confirming the three-column UNION shape.
The category parameter accepts UNION SELECT NULL,NULL,NULL and the normal product listing returns, confirming the three-column UNION shape.

Verification

The lab is confirmed when ORDER BY 3 succeeds, ORDER BY 4 fails, and UNION SELECT null,null,null adds the required all-null row. The captured result and the Academy solved state provide the verification; an ordinary status code alone does not.

Impact and defensive lesson

Knowing the column count enables reliable UNION extraction. Parameterize the category value and return uniform errors so query-shape probing does not become an oracle.

References