Question

During a web application assessment, you identify a product-listing page with a parameter (?id=12) that appears vulnerable to SQL injection. Before extracting data via a UNION-based attack, you need to determine the number of columns returned by the original query. Which technique should you use FIRST to reliably enumerate the correct column count?

Accepted Answer

Inject sequential 'ORDER BY n--' statements, incrementing n until the application returns an error

Answer

Inject 'UNION SELECT NULL-- ' and immediately attempt to read table names from information_schema

Answer

Append 'AND 1=1--' and 'AND 1=2--' to confirm boolean-based blind injection timing differences

Answer

Submit 'WAITFOR DELAY '0:0:10'--' to measure response latency and infer column structure