Getting the column names of a table by brute force blind SQL injection

Question

Is there a way of getting the column names of a table by brute force blind SQL injection in MySQL. so the query would be:

select column_name from information_schema.columns WHERE table_name = ‘tablename’ and *column names first letter = "a"* 

so if the first column name of that table does not begin with 'a', it would return an error if it did begin with 'a' it wouldn't. and do the same for the second, third letters and so on working through the alphabet. Is this possible? or is there a more efficient way maybe? Thanks

Answer 1

There are several ways of getting the column names in mysql, and the kind of attacks that are feasible will depend on the application being attacked.

For a generic answer, I would recommend studying the way SQLmap is able to discover the column, table or database names.

Answer 2

I had to do a Time based blind SQL injections sometime ago during a pentest. SQLMAP could not exploit it for some reason so I had to manually use the SQL LIKE with wildcards to bruteforce the column names along with sleep() function since I did not get any errors back on the screen.

Try SQLMAP first, if it doesn't work. Best way is to bruteforce using a wordlist with commonly used column names ('id','type',etc. based on the web framework)

For example, if you don't find 'id', You could do something like this to get the columns manually using wild card entires

SELECT column_name
FROM information_schema.columns
WHERE table_name = 'your_table'
    AND column_name LIKE '%id%'

Should return positive if there are column names containing 'id' in them.