Finding how many columns:
SELECT query BY ORDER BY
Finding column number by ORDER BY can speed up the UNION SQL Injection process.
ORDER BY 1-- ORDER BY 2-- ORDER BY N-- so on
Keep going until get an error.
Error means you found the number of selected columns.