-3

I want to know the table name and column names of that table in website login page. How should I do that.

There are only two input fields, Username and Password.

And it is vulnerable to Sql injection, because when I inject 1'or'1'='1 it logs me in with dummy values.

I am learning sql injection, and testing on this site http://sqlzoo.net/hack/index.html

  • 1
    In order to determine that, you'll need to know the dbms. However, I don't think this website will assist you in performing illegal operations. – Jeroen - IT Nerdbox Nov 10 '14 at 6:25
  • No I am not doing anything which is a crime. I am just learning sql injection. I know some mysql but need some assistance. – learner Nov 10 '14 at 6:26
4

In general, there are two ways to figure out table and column names:

  1. Inspect the software's source code or the tables it creates when installed.
  2. Blind guessing -- the username and password fields are often named things like "username" and "password", and are often in tables with names like "users" or "accounts".

Sometimes you can get them from triggering an error and inspecting the resulting error message, but most software doesn't provide useful error messages these days.

  • 2
    I wouldn't call it blind guessing. Because you are basing this on development patterns I'd call it educated guessing. – sir_k Nov 10 '14 at 9:30
  • You can also just look the names up in the database you have access to. There are certain extraction techniques that can be used in this case. – Gumbo Nov 10 '14 at 17:13
  • 1
    When the DBMS is MySQL >= 5, the information_schema can be used to retrieve the table and column names. – Jeroen - IT Nerdbox Nov 12 '14 at 6:14
3

The term you are looking for is "enumeration". There are many ways to enumerate a database, and many tools have this option, too.

  1. You can try to craft a query that tests the length of the column name, then iterate through the alphabet.

  2. You can query the data dictionary to ask the db itself

  3. Use sqlmap

Google searches would be easier if you included the 'enumerate' keyword.

0

Check out your own posted link. It has a section where it describes in detail what you are asking for. With some modification this should also be applicable to column names. find table names

Check out the following webpage sql-injection cheatsheet that should give enough ideas on how to achieve what you are looking for.

Here is an example for MySQL db (you will need to combine these with your payload e.g. ' union select ... and 1='1 or similar):

List Columns:

SELECT table_schema, table_name, column_name FROM 
information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != 
‘information_schema’

List Tables:

SELECT table_schema,table_name FROM information_schema.tables 
WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’

Just google for sql-injection + cheatsheet + enumeration. That should give you plenty of additional information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.