Getting DB name in SQLInjection
I am studiying SQLInjection in some training webpages (so I don't know what is the backend). I am triying next injection to get de DB type.
(1) http://url/?departamento=1 union select user()
By this way, if the DB is MySQL, I should get some results. However, I don't see any results. If I change the injection to this new sentence, the data is returned correctly, so the DB is MySQL (Even I can see the DB name with this new injection):
(2) http://url/?departamento=1 union select 1,user()
Nevertheless, If I change again the injection to one of these the results change.
(3) http://url/?departamento=1 union select 1,2,user() (I don't see any data)
(4) http://url/?departamento=1 union select user(),2 (Here I don't see the DB name)
I don't understand why should I add (in the 2nd select statement) more columns to see the data. Why is this happening?
Thanks!
mysql sql database sql-injection
asked Nov 25 '18 at 19:15
Miguel.GMiguel.G
9810
add a comment |
I am studiying SQLInjection in some training webpages (so I don't know what is the backend). I am triying next injection to get de DB type.
(1) http://url/?departamento=1 union select user()
By this way, if the DB is MySQL, I should get some results. However, I don't see any results. If I change the injection to this new sentence, the data is returned correctly, so the DB is MySQL (Even I can see the DB name with this new injection):
(2) http://url/?departamento=1 union select 1,user()
Nevertheless, If I change again the injection to one of these the results change.
(3) http://url/?departamento=1 union select 1,2,user() (I don't see any data)
(4) http://url/?departamento=1 union select user(),2 (Here I don't see the DB name)
I don't understand why should I add (in the 2nd select statement) more columns to see the data. Why is this happening?
Thanks!
mysql sql database sql-injection
asked Nov 25 '18 at 19:15
Miguel.GMiguel.G
9810
1
If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing thedepartamento=1parameter expects two fields.
– digijay
Nov 25 '18 at 19:21
@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D
– Miguel.G
Nov 25 '18 at 19:24
1
It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)
– digijay
Nov 25 '18 at 19:32
add a comment |
I am studiying SQLInjection in some training webpages (so I don't know what is the backend). I am triying next injection to get de DB type.
(1) http://url/?departamento=1 union select user()
By this way, if the DB is MySQL, I should get some results. However, I don't see any results. If I change the injection to this new sentence, the data is returned correctly, so the DB is MySQL (Even I can see the DB name with this new injection):
(2) http://url/?departamento=1 union select 1,user()
Nevertheless, If I change again the injection to one of these the results change.
(3) http://url/?departamento=1 union select 1,2,user() (I don't see any data)
(4) http://url/?departamento=1 union select user(),2 (Here I don't see the DB name)
I don't understand why should I add (in the 2nd select statement) more columns to see the data. Why is this happening?
Thanks!
mysql sql database sql-injection
asked Nov 25 '18 at 19:15
Miguel.GMiguel.G
9810
I am studiying SQLInjection in some training webpages (so I don't know what is the backend). I am triying next injection to get de DB type.
(1) http://url/?departamento=1 union select user()
By this way, if the DB is MySQL, I should get some results. However, I don't see any results. If I change the injection to this new sentence, the data is returned correctly, so the DB is MySQL (Even I can see the DB name with this new injection):
(2) http://url/?departamento=1 union select 1,user()
Nevertheless, If I change again the injection to one of these the results change.
(3) http://url/?departamento=1 union select 1,2,user() (I don't see any data)
(4) http://url/?departamento=1 union select user(),2 (Here I don't see the DB name)
I don't understand why should I add (in the 2nd select statement) more columns to see the data. Why is this happening?
Thanks!
mysql sql database sql-injection
mysql sql database sql-injection
asked Nov 25 '18 at 19:15
Miguel.GMiguel.G
9810
asked Nov 25 '18 at 19:15
Miguel.GMiguel.G
9810
asked Nov 25 '18 at 19:15
Miguel.GMiguel.G
9810
asked Nov 25 '18 at 19:15
Miguel.GMiguel.G
9810
asked Nov 25 '18 at 19:15
Miguel.GMiguel.G
9810
9810
1
If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing thedepartamento=1parameter expects two fields.
– digijay
Nov 25 '18 at 19:21
@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D
– Miguel.G
Nov 25 '18 at 19:24
1
It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)
– digijay
Nov 25 '18 at 19:32
add a comment |
1
If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing thedepartamento=1parameter expects two fields.
– digijay
Nov 25 '18 at 19:21
@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D
– Miguel.G
Nov 25 '18 at 19:24
1
It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)
– digijay
Nov 25 '18 at 19:32
1
1
If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing the
departamento=1 parameter expects two fields.– digijay
Nov 25 '18 at 19:21
If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing the
departamento=1 parameter expects two fields.– digijay
Nov 25 '18 at 19:21
@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D
– Miguel.G
Nov 25 '18 at 19:24
@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D
– Miguel.G
Nov 25 '18 at 19:24
1
1
It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)
– digijay
Nov 25 '18 at 19:32
It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)
– digijay
Nov 25 '18 at 19:32
add a comment |
1 Answer
1
active
oldest
votes
Suppose the backend is Java, the code is doing something similar to that:
// 1 union select 1,user()
String query = "select a, b, c from someTable where departamento = "
+ request.getParameter("departamento"); // the injection is here
try (Statement stmt = con.createStatement()) {
try (Result rs = stmt.executeQuery()) {
while (rs.next()) {
int a = rs.getInt(1); // column "a"
String b = rs.getString(2); // column "b"
Date c = rs.getDate(3); // column "c"
System.out.println("a: " + a + ", b: " + b + ", " c: " + c);
}
}
}
For the injection to work, you need to generate a valid SQL statement.
- Your union must have the same number of columns than the source query
- Your column type must match; type of columns in first subquery must be the same than in second subquery (some database may fail the query because of that).
- Your criteria ("1") must match the right hand side of the filter (
departemento) - Probably specific to Java (and this example), for the loop to work, you need to be able to cast your column to its target type. If column 1 is a number, then it is likely you'll never be able to display its content if your union produce a string not convertible to a number.
answered Nov 25 '18 at 19:26
NoDataFoundNoDataFound
5,8311841
Thank you! It was very useful :)
– Miguel.G
Nov 28 '18 at 10:47
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53470986%2fgetting-db-name-in-sqlinjection%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Suppose the backend is Java, the code is doing something similar to that:
// 1 union select 1,user()
String query = "select a, b, c from someTable where departamento = "
+ request.getParameter("departamento"); // the injection is here
try (Statement stmt = con.createStatement()) {
try (Result rs = stmt.executeQuery()) {
while (rs.next()) {
int a = rs.getInt(1); // column "a"
String b = rs.getString(2); // column "b"
Date c = rs.getDate(3); // column "c"
System.out.println("a: " + a + ", b: " + b + ", " c: " + c);
}
}
}
For the injection to work, you need to generate a valid SQL statement.
- Your union must have the same number of columns than the source query
- Your column type must match; type of columns in first subquery must be the same than in second subquery (some database may fail the query because of that).
- Your criteria ("1") must match the right hand side of the filter (
departemento) - Probably specific to Java (and this example), for the loop to work, you need to be able to cast your column to its target type. If column 1 is a number, then it is likely you'll never be able to display its content if your union produce a string not convertible to a number.
answered Nov 25 '18 at 19:26
NoDataFoundNoDataFound
5,8311841
Thank you! It was very useful :)
– Miguel.G
Nov 28 '18 at 10:47
add a comment |
Suppose the backend is Java, the code is doing something similar to that:
// 1 union select 1,user()
String query = "select a, b, c from someTable where departamento = "
+ request.getParameter("departamento"); // the injection is here
try (Statement stmt = con.createStatement()) {
try (Result rs = stmt.executeQuery()) {
while (rs.next()) {
int a = rs.getInt(1); // column "a"
String b = rs.getString(2); // column "b"
Date c = rs.getDate(3); // column "c"
System.out.println("a: " + a + ", b: " + b + ", " c: " + c);
}
}
}
For the injection to work, you need to generate a valid SQL statement.
- Your union must have the same number of columns than the source query
- Your column type must match; type of columns in first subquery must be the same than in second subquery (some database may fail the query because of that).
- Your criteria ("1") must match the right hand side of the filter (
departemento) - Probably specific to Java (and this example), for the loop to work, you need to be able to cast your column to its target type. If column 1 is a number, then it is likely you'll never be able to display its content if your union produce a string not convertible to a number.
answered Nov 25 '18 at 19:26
NoDataFoundNoDataFound
5,8311841
Thank you! It was very useful :)
– Miguel.G
Nov 28 '18 at 10:47
add a comment |
Suppose the backend is Java, the code is doing something similar to that:
// 1 union select 1,user()
String query = "select a, b, c from someTable where departamento = "
+ request.getParameter("departamento"); // the injection is here
try (Statement stmt = con.createStatement()) {
try (Result rs = stmt.executeQuery()) {
while (rs.next()) {
int a = rs.getInt(1); // column "a"
String b = rs.getString(2); // column "b"
Date c = rs.getDate(3); // column "c"
System.out.println("a: " + a + ", b: " + b + ", " c: " + c);
}
}
}
For the injection to work, you need to generate a valid SQL statement.
- Your union must have the same number of columns than the source query
- Your column type must match; type of columns in first subquery must be the same than in second subquery (some database may fail the query because of that).
- Your criteria ("1") must match the right hand side of the filter (
departemento) - Probably specific to Java (and this example), for the loop to work, you need to be able to cast your column to its target type. If column 1 is a number, then it is likely you'll never be able to display its content if your union produce a string not convertible to a number.
answered Nov 25 '18 at 19:26
NoDataFoundNoDataFound
5,8311841
Suppose the backend is Java, the code is doing something similar to that:
// 1 union select 1,user()
String query = "select a, b, c from someTable where departamento = "
+ request.getParameter("departamento"); // the injection is here
try (Statement stmt = con.createStatement()) {
try (Result rs = stmt.executeQuery()) {
while (rs.next()) {
int a = rs.getInt(1); // column "a"
String b = rs.getString(2); // column "b"
Date c = rs.getDate(3); // column "c"
System.out.println("a: " + a + ", b: " + b + ", " c: " + c);
}
}
}
For the injection to work, you need to generate a valid SQL statement.
- Your union must have the same number of columns than the source query
- Your column type must match; type of columns in first subquery must be the same than in second subquery (some database may fail the query because of that).
- Your criteria ("1") must match the right hand side of the filter (
departemento) - Probably specific to Java (and this example), for the loop to work, you need to be able to cast your column to its target type. If column 1 is a number, then it is likely you'll never be able to display its content if your union produce a string not convertible to a number.
answered Nov 25 '18 at 19:26
NoDataFoundNoDataFound
5,8311841
answered Nov 25 '18 at 19:26
NoDataFoundNoDataFound
5,8311841
answered Nov 25 '18 at 19:26
NoDataFoundNoDataFound
5,8311841
answered Nov 25 '18 at 19:26
NoDataFoundNoDataFound
5,8311841
5,8311841
Thank you! It was very useful :)
– Miguel.G
Nov 28 '18 at 10:47
add a comment |
Thank you! It was very useful :)
– Miguel.G
Nov 28 '18 at 10:47
Thank you! It was very useful :)
– Miguel.G
Nov 28 '18 at 10:47
Thank you! It was very useful :)
– Miguel.G
Nov 28 '18 at 10:47
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53470986%2fgetting-db-name-in-sqlinjection%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing the
departamento=1parameter expects two fields.– digijay
Nov 25 '18 at 19:21
@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D
– Miguel.G
Nov 25 '18 at 19:24
1
It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)
– digijay
Nov 25 '18 at 19:32