I was practising on OWASP Mutillidae, and I met a problem. There's a task that examines our knowledge of UNION query.

The vulnerable query is:

SELECT * FROM accounts WHERE username='

The accounts table has 5 columns, and we want to obtain schema_name from information_schema.schemata

So I write [John' UNION ...] in the username box and the query should become to this:

SELECT * FROM accounts WHERE username='John' UNION SELECT NULL,NULL,NULL,schema_name,NULL FROM information_schema.schemata

But it will return Syntax error or the number of columns is wrong.

How should I write the malicious string to make it work? Thanks!

  • 1
    You select 5 columns in your union but accounts contain either more or less columns. First you'll have to figure out how many columns the accounts table contains. Either by starting with one NULL and adding until you have a result, or look at the result of the request. I would expect it to contain the result where you can infer the amount of columns. Feb 5 '21 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.