sup.
this tut will focus on injection via headers.

up to now,we knew 3 methods to inject.
GET- via url.
for example-
http://evt-me.com/newsDetail.php?id=8
POST - via box.
for example-
http://www.health.gov.mv/ (in the search)
now we gonna learn via HEADER.
lets start.
if we have this site
http://www.teletec.com.pk/products.php (thanks to Rohan_x)
and we wanna inject it,we are looking for some parameter to inject in.
(something=somthing [id=1 for example])

no parameter.
lets try to add parameter by select stuff.

still no parameter. or yes? lets open 'live http header'.

you see the hidden parameters? the url in the GET is the refereer,that why we cant see it un the url.
lets edit the url and start injecting. click the url in the LHH,and type repley.

as you can see,we got a lot of parameters,we have to inject in the right one.
rw=20 : after limit,not good.
sb=id : after order by,not good.
pr=price.... : after and,good.
our injection point is after '3000'.

notice we can see the full query,lets count columns.
if you dont know what i did,read my tut
http://www.hackforums.net/showthread.php?tid=2125898

60 columns.
so
column 4 vuln.
so
and

why is this happening?
while we click on some url in our browser,this is the request
our inject is in the headers.

摘自 http://hi.baidu.com/evilrapper/blog/item/66025dddcc7c5dcf76c638a2.html