I'm learning about SQL injection and have the following backend code,

Set rs = server.CreateObject("ADODB.Recordset")
SQL = "SELECT * FROM Registration WHERE name='"&name&"'"
rs.Open SQL,Conn,0,1
if not rs.EOF then
    message = "Your ID is """ & rs("iD") & """."
    message = "id does not exist."
end if

I have been able to inject this to pull out a iD, but I'm wondering if it would be possible to go even further and get more info? Based on my code I don't think that is possible since my code only returns the iD DB field.

Am I right?

  • 1
    Can you clarify the title? You say "Oracle MSSQL", but Oracle's version of SQL is called PL/SQL, and MSSQL is typically an abbreviation for "Microsoft SQL Server" and its version of SQL is known as T-SQL or Transact-SQL. This makes it hard to figure out which one you're taking about, though the code looks like SQL Server's T-SQL, not Oracle's PL/SQL.
    – Xander
    Commented Apr 2, 2013 at 20:01

3 Answers 3


To exploit this vulnerability, one doesn’t need a direct output. There is also a technique called boolean-based blind where the behavior of different boolean expressions is used to extrapolate the data from:

foo' AND pass LIKE 'a%

If the success message is returned, pass begins with a, otherwise it doesn’t. If you repeat that with all possible characters recursively on each successful prefix, you’ll get the whole string.

You can do the same to get information about the database schema:


With the knowledge of the database schema, one can read any data.

As Rook has already mentioned, SQLmap is quite a useful tool to automate the exploitation of such SQL injection vulnerabilities.


You could alias a record to give any single column return using an As in the select. There is also the issue that you could send any arbitrary alteration to the DB as well assuming that "name" comes from unvalidated user input.

  • Hi AJ, so means that I am only able to list one record at a time right? If lets say I wanted to query the DB for a list of everything in Registration table it would not come out right?
    – d123
    Commented Apr 2, 2013 at 19:44
  • this is the query I'm using: ' OR EXISTS(SELECT * FROM Registration) AND ''=' My table has 4 fields at the moment iD, name, email, pass. From an attacker's perspective, let say I know the table name, but I don't know how many users are in the db and assuming iD is a random number or not even a number, what methods can I use to scrape info from the table?
    – d123
    Commented Apr 2, 2013 at 19:48
  • 2
    @d123 Not neccessarily, you could for example build a concatenation of results in to a custom field and do an AS to make that custom concatenated field to iD and then the entire contents would be dumped. Commented Apr 2, 2013 at 19:49
  • Could you show me an example?
    – d123
    Commented Apr 2, 2013 at 19:53

SQLMap is a great tool that automates the exploitation of flaws like this. SQLMap can dump an entire database, even if it is blind sql injection. It can also pop a shell depending on the database's configuration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .