SQL Injection Attacks and Defense - 2009

MySQL
Exploiting SQL Injection • Chapter 4 177
Also on MySQL, the technique for enumerating a database and extracting its data follows a
hierarchical approach: You start extracting the names of the databases, and then proceed
down to tables, columns, and finally the data itself.
The first thing you are usually interested in is the name of the user performing the
queries. You can retrieve this with one of the following queries:
SELECT user();
SELECT current_user;
To list the databases that are present on the remote MySQL installation, you can use the
following query, if you have administrative privileges:
SELECT distinct(db) FROM mysql.db;
If you don’t have administrative privileges, but the remote MySQL version is 5.0 or later,
you can still obtain the same information using information_schema, by injecting the following
alternative:
SELECT schema_name FROM information_schema.schemata;
Querying information_schema allows you to enumerate the whole database structure.
Once you have retrieved the databases, and you have found one of them that looks particularly
interesting (e.g., customers_db), you can extract its table names with the following query:
SELECT table_schema,table_name FROM information_schema.tables WHERE
table_schema = 'customers_db'
If you prefer to obtain a list of all the tables of all databases, you can simply omit the
WHERE clause, but you might want to modify it as follows:
SELECT table_schema,table_name FROM information_schema.tables WHERE
table_schema != 'mysql' AND table_schema != 'information_schema'
Such a query will retrieve all tables except the ones belonging to mysql and information_
schema, two built-in databases whose tables you are probably not interested in. Once you
have the tables it is time to retrieve the columns, again avoiding all entries that belong to
mysql and information_schema:
SELECT table_schema, table_name, column_name FROM information_schema.columns
WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
This query will provide you with a comprehensive view of all databases, tables, and
columns, all packaged in one nice table, as you can see in the following example:
mysql> SELECT table_schema, table_name, column_name FROM
information_schema.columns WHERE table_schema != 'mysql' AND
table_schema != 'information_schema';