If you got the tablename you can brute its columns. Once you got the right letter, move on to the next:ġ′ AND MID((SELECT table_name FROM information_schema.tables WHERE version = 9 LIMIT 1),2,1) > ‘m As stated above, version=9 has nothing to do with the MySQL version number and is used here to fetch only user generated tables. We’ll use the same injection as in 1.), but now with blind injection technique:ġ′ AND MID((SELECT table_name FROM information_schema.tables WHERE version = 9 LIMIT 1),1,1) > ‘mĪgain, this will check if the first letter of our first table is alphabetically located behind “m”. Yes, that can be annoying, but who said it would be easy? Since we cant read out the table name we have to brute it. Once we know the version number you can proceed with these steps (MySQL >= 5.0) or jump to the next point. I’d suggest you to try some values first to get a acceptable response time. If the output does not differ, no matter what you’ll inject try some benchmark tests:ġ′ UNION SELECT (if(mid(version(),1,1) like 4, benchmark(100000,sha1(‘test’)), ‘false’)),null /*īut be careful with the benchmark values, you dont want to crash your browser -). Check it out:Īlways remember to put a value before the actual injection which would give “normal” output. If not, I’ll guess the server is running MySQL 5. The request will be successfull and the same page will be displayed like as we did no injection if the version starts with “4”. If you really need blind SQL injection we’ll go through the same steps as above, so first we try to get the version: Use something like AND 1=0 to make sure the actual output is null and then append your union select to get your data, for example:

Often you just have to make sure the actual result returns null and the output of your injection gets processed by the mysql_functions instead. However, make sure you really need to use blind injection. Sometimes you can’t see the output of your request, however there are some techniques to get the info blindly, called Blind SQL Injection. There you’ll find other interesting columns you can add instead of null, for example data_type.ġ.b.

Once you know all table names and column names you can union select all the data you need.įor more details about the information_schema table see the MySQL Documentation Library. If the webapplication is designed to output only the first line of the resultset you can use LIMIT x,1 (starting with x=0) to iterate your result line by line.Ġ′ UNION SELECT column_name,null FROM information_lumns WHERE table_name = ‘tablename’ LIMIT 3,1Īlso, you can use group_concat() to concatenate all table/column names to one string and therefore also return only one line:Ġ′ UNION SELECT group_concat(column_name),null FROM information_lumns WHERE table_name = ‘tablename

Unfortunetly there is no unique identifier, so you have to scroll through the whole information_schema table if you use this. instead of the unique identifier you can also use “LIMIT offset,amount”.Ġ′ UNION SELECT column_name,null FROM information_lumns WHERE table_name = ‘tablenameĠ′ UNION SELECT column_name,table_name FROM information_lumns /* so dont worry if you dont get any results. Update: Testing another MySQL version (5.0.51a) I noticed that the version is “10” for user generated tables. It’s just an unique identifier for user generated tables, so leave as it is to ignore MySQL system table names. Note that version=9 has nothing to do with the MySQL version. You can either get the names step by step or at once.Ġ′ UNION SELECT table_name,null FROM information_schema.tables WHERE version = ‘9 Once you know which version is running, proceed with these steps (MySQL >= 5.0) or jump to the next point. So you may want to check which MySQL version is running: Sometimes on MySQL >=5.0 you can access the information_schema table. My injections are written for a SELECT query with two columns, however don’t forget to add nulls in the right amount.ġ.a.

This article is for learning purposes only.įor the following injections I’ll assume you understand the basics of SQL injection and union select. Please note that attacking websites you are not allowed to attack is a crime and should not be done. For other databases I recommend the extensive cheat sheets from pentestmonkey. So this article shows you how I would try to get the data in different scenarios on MySQL. Often you need them to start further SQLi attacks to get the data. Getting the table and column names within a SQL injection attack is often a problem and I’ve seen a lot of questions about this on the internet.

Mysql union unique name