[D@rk1433]

Brawler sir i am reading those sites which you mentioned and now i am understanding what i did earlier. So sorry And thank you so much for give me those sites Sir just a little request as i am noob in this field and still learning so if i need help then you help me in this web hacking and security fields. Because you expert guys are here for give us right direction

[Reiko]

@Brawler I wasn't criticising you. I was criticising the OP. If you are serious about avoiding a filter that looks specifically for "UNION SELECT", then you will not use "UNION SELECT" at all.

Oversimplified example: some.php?query=1&&(some_condition_for_boolean_enumeration)like(1)
Of course, you should URL-encode the &s (%26%26)

A nice read on the subject, since we're only talking about SQL injection here: https://websec.wordpress.com/2010/03/19/...njections/
The same author has more posts on the same subject. I'm not going to link them. If you want to read them, you can find them really easily on the same site.

[Th3PonyWizard]

Any sane WAF is preg_match'ing group_replace. Same thing with concat_ws and concat. If people have a brain, they learn SQL, if they learn SQL they understand you can concentrate columns off a table using more than one function. EXPORT_SET and REPLACE() for a start, stop being depended on concat

To understand how a WAF works, download mod_security throughout it's ages and years and see how it progressed. The lower the state of the IDS/WAF is from the website, the less effective it is. If, say, you make a PHP based WAF, you can usually rest peacefully. But the more layers, services and turns the input goes the more you can play and twist with it. Don't learn how to bypass from tutorials, learn SQL throughtly, website tiers, SQL engine and such.

"http://www.site.com/php?id=3+ ----> We use + to check is spaces is block or not by WAF. If you see error by using + it means spaces is block & if no error means spaces is not block Smile "

This shows you don't grasp the concepts. Spaces are spaces. What translates these signs into spaces isn't the SQL engine, isn't the PHP interpreter, isn't the CGI nor PHP interpreter, it's your browser. Browsers follow RFC's, rules that are being shared by all of them in order to make the web not as diverted as it is (Although they failed at that, html interpretations..) a plus sign from a space is your usual URL Encoding. Not SQL. It's + and not %20 to be an alternative soley for the URL parameters of the URL which are usually relating to a form (application/x-www-form-urlencoded)

If spacing is problematic at a WAF, use /**/ or whitespaces such %0d.

---

@Brawler I wasn't criticising you. I was criticising the OP. If you are serious about avoiding a filter that looks specifically for "UNION SELECT", then you will not use "UNION SELECT" at all.

Oversimplified example: some.php?query=1&&(some_condition_for_boolean_enumeration)like(1)
Of course, you should URL-encode the &s (%26%26)

A nice read on the subject, since we're only talking about SQL injection here: https://websec.wordpress.com/2010/03/19/...njections/
The same author has more posts on the same subject. I'm not going to link them. If you want to read them, you can find them really easily on the same site.

That scenario is only plausible in certain cases.

[Reiko]

That scenario is only plausible in certain cases.

Uh.. yeah. That's implied throughout my entire post, but alright.

[Schism]

Thanks for this guide! Very informative. Thank you

And for all the comments I've read too