I have a question I am hoping someone could help with..
I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but this one has to be written from scratch).
The problem I am having:
When manually performing SQL injection to determine tables names or column names and so on using strings such as:
www.vulnerable site.net/articles.php?id =-1 union select 1,2,group_concat(column_name),4 from information_schema.columns --
www.vulnarable site.net/articles.php?id =-1 union select 1,2,table_name,4 from information_schema.tables --
it is easy to determine the table names/column names as you can simply look at the page and read the column names that are returned in the page content.
But how can this be done in an automated way?
Doing this in an automated fashion is a lot harder though because how does the tool know what on the page that is returned when the sql injection is executed are table names/column names?
What would be the most reliable way to do this so the tool knows what parts of the page content to extract because they are table names/column names?
for example... could I parse/search the page content for strings seperated by commas to get the table and column names that are output by the injection? Is there better more reliable ways to do it?
your help with this is much appreciated, many thanks