Error based enum

[secf00tprint]

Add error based enumeration in section Error Based Injection using
ORDER BY and a increasing number to determine amount of columns, e.g.

value ORDER BY 1 => correct response (sorted by first column)
value ORDER BY 2 => correct response (sorted by second column)
value ORDER BY .. => ...
value ORDER BY 6 => error => You can infer table must have 5 columns

[secf00tprint]

Added error based enumeration in section Error Based Injection using UNION SELECT with tags
e.g.
UNION SELECT 1 => not working
UNION SELECT 1,2 => not working
UNION SELECT 1,2,3 => working. You can try to find tags 1 to 3 in the rendered response. If so you know you can do union select to add arbitrary custom select and view the result.

Furthermore added reference in Union Based Injection Description to Error Based Injection how to find amount of columns.