An Access brute-force field Technique

Note: I don't know if anyone has ever sent a message. It was suddenly detected in the test today.
 
Condition: access database, injection exists, and error echo exists.
 
Let's take a look at this SQL statement: after running select * from next where id = 1 ORDER BY sum (1), a field will appear. Of course, the second and third fields cannot be violent. Only the first one can be exposed.
 
Utilization Value
 
In fact, this exploitation value can only be used in the case that a website has SQL statements but cannot guess fields in the table, generally, the xxx _ field is added to the field. If a field can be exposed, it may be xxx_xxx, so you can guess that it uses the xxx _ prefix as the field.
 
 
 
Comments: www.2cto.com
 
You can view the source code in the login port, and search for "name =" to see some fields.
 
Reply upstairs: after all, the background search is a minority! How can this problem be solved!
 
Why can't I do it first !!!!!
 
Ghost brother: I don't know either. Haha ..
 
Indicates that the second condition is not displayed if your condition id = 2!