Completely blind SQL injection column enumeration?

Question

I'm doing a school project about webapp security and vulnerabilities, and for that i've made my own very simple website with a login and a search bar.

Now, i've made the login silent on purpose, while the search bar shows output on SQL injections. So for demonstration purposes I would like to do a time-based completely blind SQL injection attack on the login... But i'm a bit stuck.

I have no idea how I can enumerate how many columns are in the table for the login query, in a time-based situation:

SELECT * FROM customer WHERE cMAIL='' AND cPWD='';

I cannot do ORDER BY n;#, since I get absolutely no error output when something goes wrong. The only way I can get any indication is through SLEEP() or BENCHMARK().

But I cannot put ORDER BY into a SELECT IF() statement. So how can I find out how many columns exist? (it makes unions impossible for me).

Thank you!

EDIT: It might be worth mentioning, the site is very unsecure on purpose (doesn't use mysqli, just mysql). Since it is just for demonstration

Answer 1

Okay, I found an answer to my own question:

Instead of using ORDER BY, I used SELECT and bruteforced my way to see how many columns existed:

SELECT * FROM customer WHERE cMAIL='' AND cPWD='';

Can be enumerated in the dark by doing:

SELECT * FROM customer WHERE cMAIL='' UNION SELECT null,null,null AND SLEEP(5);# AND cPWD=''

You just keep adding more nulls to the select until the database sleeps for 5 seconds. Then you know how many columns are in the given table.

Hope this can help someone else.