Getting DB name in SQLInjection

I am studiying SQLInjection in some training webpages (so I don't know what is the backend). I am triying next injection to get de DB type.

(1) http://url/?departamento=1 union select user()

By this way, if the DB is MySQL, I should get some results. However, I don't see any results. If I change the injection to this new sentence, the data is returned correctly, so the DB is MySQL (Even I can see the DB name with this new injection):

(2) http://url/?departamento=1 union select 1,user()

Nevertheless, If I change again the injection to one of these the results change.

(3) http://url/?departamento=1 union select 1,2,user() (I don't see any data)

(4) http://url/?departamento=1 union select user(),2 (Here I don't see the DB name)

I don't understand why should I add (in the 2nd select statement) more columns to see the data. Why is this happening?

Thanks!

asked Nov 25 '18 at 19:15

Miguel.G

9810

1

If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing the departamento=1 parameter expects two fields.

– digijay
Nov 25 '18 at 19:21

@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D

– Miguel.G
Nov 25 '18 at 19:24

1

It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)

– digijay
Nov 25 '18 at 19:32

add a comment |

I am studiying SQLInjection in some training webpages (so I don't know what is the backend). I am triying next injection to get de DB type.

(1) http://url/?departamento=1 union select user()

(2) http://url/?departamento=1 union select 1,user()

Nevertheless, If I change again the injection to one of these the results change.

(3) http://url/?departamento=1 union select 1,2,user() (I don't see any data)

(4) http://url/?departamento=1 union select user(),2 (Here I don't see the DB name)

I don't understand why should I add (in the 2nd select statement) more columns to see the data. Why is this happening?

Thanks!

asked Nov 25 '18 at 19:15

Miguel.G

9810

1

If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing the departamento=1 parameter expects two fields.

– digijay
Nov 25 '18 at 19:21

@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D

– Miguel.G
Nov 25 '18 at 19:24

1

It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)

– digijay
Nov 25 '18 at 19:32

add a comment |

I am studiying SQLInjection in some training webpages (so I don't know what is the backend). I am triying next injection to get de DB type.

(1) http://url/?departamento=1 union select user()

(2) http://url/?departamento=1 union select 1,user()

Nevertheless, If I change again the injection to one of these the results change.

(3) http://url/?departamento=1 union select 1,2,user() (I don't see any data)

(4) http://url/?departamento=1 union select user(),2 (Here I don't see the DB name)

I don't understand why should I add (in the 2nd select statement) more columns to see the data. Why is this happening?

Thanks!

asked Nov 25 '18 at 19:15

Miguel.G

9810

I am studiying SQLInjection in some training webpages (so I don't know what is the backend). I am triying next injection to get de DB type.

(1) http://url/?departamento=1 union select user()

(2) http://url/?departamento=1 union select 1,user()

Nevertheless, If I change again the injection to one of these the results change.

(3) http://url/?departamento=1 union select 1,2,user() (I don't see any data)

(4) http://url/?departamento=1 union select user(),2 (Here I don't see the DB name)

I don't understand why should I add (in the 2nd select statement) more columns to see the data. Why is this happening?

Thanks!

mysql sql database sql-injection

asked Nov 25 '18 at 19:15

Miguel.G

9810

asked Nov 25 '18 at 19:15

Miguel.G

9810

asked Nov 25 '18 at 19:15

Miguel.G

9810

asked Nov 25 '18 at 19:15

Miguel.G

9810

asked Nov 25 '18 at 19:15

Miguel.G

9810

1

If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing the departamento=1 parameter expects two fields.

– digijay
Nov 25 '18 at 19:21

@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D

– Miguel.G
Nov 25 '18 at 19:24

1

It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)

– digijay
Nov 25 '18 at 19:32

add a comment |

1

If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing the departamento=1 parameter expects two fields.

– digijay
Nov 25 '18 at 19:21

@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D

– Miguel.G
Nov 25 '18 at 19:24

1

It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)

– digijay
Nov 25 '18 at 19:32

If you use the UNION operator then the number of fields of the first query has to be identical to the number of fields of the second query. So I guess that the statement processing the departamento=1 parameter expects two fields.

– digijay
Nov 25 '18 at 19:21

@D.Joe Nice Thanks! I was reading the documentation but I didn't understand it. This is really helpful since I get DBName@Username. That is why I can see the DB name too. Thanks again!! :D

– Miguel.G
Nov 25 '18 at 19:24

It's just like in this cartoon: xkcd.com/327 Keep hacking! :o)

– digijay
Nov 25 '18 at 19:32

add a comment |

1 Answer
1

active

oldest

votes

Suppose the backend is Java, the code is doing something similar to that:

// 1 union select 1,user()

String query = "select a, b, c from someTable where departamento = " 

             + request.getParameter("departamento"); // the injection is here

try (Statement stmt = con.createStatement()) {

  try (Result rs = stmt.executeQuery()) {

    while (rs.next()) {

      int a = rs.getInt(1); // column "a"

      String b = rs.getString(2); // column "b"

      Date c = rs.getDate(3); // column "c"

      System.out.println("a: " + a + ", b: " + b + ", " c: " + c);

    }

  }

}

For the injection to work, you need to generate a valid SQL statement.

Your union must have the same number of columns than the source query

Your column type must match; type of columns in first subquery must be the same than in second subquery (some database may fail the query because of that).

Your criteria ("1") must match the right hand side of the filter (departemento)

Probably specific to Java (and this example), for the loop to work, you need to be able to cast your column to its target type. If column 1 is a number, then it is likely you'll never be able to display its content if your union produce a string not convertible to a number.

answered Nov 25 '18 at 19:26

NoDataFound

5,8311841

Thank you! It was very useful :)

– Miguel.G
Nov 28 '18 at 10:47

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53470986%2fgetting-db-name-in-sqlinjection%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

Suppose the backend is Java, the code is doing something similar to that:

// 1 union select 1,user()

String query = "select a, b, c from someTable where departamento = " 

             + request.getParameter("departamento"); // the injection is here

try (Statement stmt = con.createStatement()) {

  try (Result rs = stmt.executeQuery()) {

    while (rs.next()) {

      int a = rs.getInt(1); // column "a"

      String b = rs.getString(2); // column "b"

      Date c = rs.getDate(3); // column "c"

      System.out.println("a: " + a + ", b: " + b + ", " c: " + c);

    }

  }

}

For the injection to work, you need to generate a valid SQL statement.

Your union must have the same number of columns than the source query

Your column type must match; type of columns in first subquery must be the same than in second subquery (some database may fail the query because of that).

Your criteria ("1") must match the right hand side of the filter (departemento)

Probably specific to Java (and this example), for the loop to work, you need to be able to cast your column to its target type. If column 1 is a number, then it is likely you'll never be able to display its content if your union produce a string not convertible to a number.

answered Nov 25 '18 at 19:26

NoDataFound

5,8311841

Thank you! It was very useful :)

– Miguel.G
Nov 28 '18 at 10:47

add a comment |

Suppose the backend is Java, the code is doing something similar to that:

// 1 union select 1,user()

String query = "select a, b, c from someTable where departamento = " 

             + request.getParameter("departamento"); // the injection is here

try (Statement stmt = con.createStatement()) {

  try (Result rs = stmt.executeQuery()) {

    while (rs.next()) {

      int a = rs.getInt(1); // column "a"

      String b = rs.getString(2); // column "b"

      Date c = rs.getDate(3); // column "c"

      System.out.println("a: " + a + ", b: " + b + ", " c: " + c);

    }

  }

}

For the injection to work, you need to generate a valid SQL statement.

Your union must have the same number of columns than the source query

Your column type must match; type of columns in first subquery must be the same than in second subquery (some database may fail the query because of that).

Your criteria ("1") must match the right hand side of the filter (departemento)

Probably specific to Java (and this example), for the loop to work, you need to be able to cast your column to its target type. If column 1 is a number, then it is likely you'll never be able to display its content if your union produce a string not convertible to a number.

answered Nov 25 '18 at 19:26

NoDataFound

5,8311841

Thank you! It was very useful :)

– Miguel.G
Nov 28 '18 at 10:47

add a comment |

Suppose the backend is Java, the code is doing something similar to that:

// 1 union select 1,user()

String query = "select a, b, c from someTable where departamento = " 

             + request.getParameter("departamento"); // the injection is here

try (Statement stmt = con.createStatement()) {

  try (Result rs = stmt.executeQuery()) {

    while (rs.next()) {

      int a = rs.getInt(1); // column "a"

      String b = rs.getString(2); // column "b"

      Date c = rs.getDate(3); // column "c"

      System.out.println("a: " + a + ", b: " + b + ", " c: " + c);

    }

  }

}

For the injection to work, you need to generate a valid SQL statement.

Your union must have the same number of columns than the source query

Your column type must match; type of columns in first subquery must be the same than in second subquery (some database may fail the query because of that).

Your criteria ("1") must match the right hand side of the filter (departemento)

Probably specific to Java (and this example), for the loop to work, you need to be able to cast your column to its target type. If column 1 is a number, then it is likely you'll never be able to display its content if your union produce a string not convertible to a number.

answered Nov 25 '18 at 19:26

NoDataFound

5,8311841

Suppose the backend is Java, the code is doing something similar to that:

// 1 union select 1,user()

String query = "select a, b, c from someTable where departamento = " 

             + request.getParameter("departamento"); // the injection is here

try (Statement stmt = con.createStatement()) {

  try (Result rs = stmt.executeQuery()) {

    while (rs.next()) {

      int a = rs.getInt(1); // column "a"

      String b = rs.getString(2); // column "b"

      Date c = rs.getDate(3); // column "c"

      System.out.println("a: " + a + ", b: " + b + ", " c: " + c);

    }

  }

}

For the injection to work, you need to generate a valid SQL statement.

Your union must have the same number of columns than the source query

Your column type must match; type of columns in first subquery must be the same than in second subquery (some database may fail the query because of that).

Your criteria ("1") must match the right hand side of the filter (departemento)

Probably specific to Java (and this example), for the loop to work, you need to be able to cast your column to its target type. If column 1 is a number, then it is likely you'll never be able to display its content if your union produce a string not convertible to a number.

answered Nov 25 '18 at 19:26

NoDataFound

5,8311841

answered Nov 25 '18 at 19:26

NoDataFound

5,8311841

answered Nov 25 '18 at 19:26

NoDataFound

5,8311841

answered Nov 25 '18 at 19:26

NoDataFound

5,8311841

Thank you! It was very useful :)

– Miguel.G
Nov 28 '18 at 10:47

add a comment |

Thank you! It was very useful :)

– Miguel.G
Nov 28 '18 at 10:47

Thank you! It was very useful :)

– Miguel.G
Nov 28 '18 at 10:47

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Nsryjdtyk