SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 173
we are only interested in the rows where the type is U. Assuming that we want to delve a little
deeper into the contents of the e–shop database, here’s the query to inject:
SELECT name FROM e–shop..sysobjects WHERE xtype='U'
The corresponding URL is obviously the following:
http://www.victim.com/products.aspid=12+union+select+null,name,null,
null+from+e–shop..sysobjects+where+xtype%3D'U'--
The page that results will look something like the screenshot shown in Figure 4.12.
Figure 4.12 Enumerating All Tables of a Specific Database
As you can see, there are some interesting tables, with customers and transactions probably
being the ones with the most promising contents! To extract that data, the next step is to
enumerate the columns of these tables. We will look at two different ways to extract the
names of the columns of a given table (e.g., customers). Here is the first one:
SELECT name FROM e–shop..syscolumns WHERE id = (SELECT id FROM
e–shop..sysobjects WHERE name = 'customers')