SQL Injection Attacks and Defense - 2009

Such a query will return output similar to the following:
+---------------------+-------------------------+--------------+
| grantee | privilege_type | is_grantable |
+---------------------+-------------------------+--------------+
| 'root'@'localhost' | SELECT | YES |
| 'root'@'localhost' | INSERT | YES |
| 'root'@'localhost' | UPDATE | YES |
| 'root'@'localhost' | DELETE | YES |
| 'root'@'localhost' | CREATE | YES |
| 'root'@'localhost' | DROP | YES |
| 'root'@'localhost' | RELOAD | YES |
| 'root'@'localhost' | SHUTDOWN | YES |
| 'root'@'localhost' | PROCESS | YES |
| 'root'@'localhost' | FILE | YES |
| 'root'@'localhost' | REFERENCES | YES |
| 'root'@'localhost' | INDEX | YES |
Exploiting SQL Injection • Chapter 4 179
If you need to know the privileges granted to users on the different databases,
the following query will do the job:
SELECT grantee, table_schema, privilege_type FROM
information_schema.schema_privileges
For space reasons, all the queries that could be useful for enumerating information for a
specific technology cannot be included, but some cheat sheets are available in Chapter 10.
Cheat sheets are also available online that can assist you in quickly locating the proper query
for handling a specific job on a specific database. One place to look is http://pentestmonkey.
net/cheat-sheets/.
Unfortunately, information_schema is available only in MySQL 5 and later, so if you are
dealing with an earlier version the process will be more difficult, as a brute-force attack might
be the only way to determine the names of tables and columns. One thing you can do
(however, it’s a little complicated) is access the files that store the database, import their raw
content into a table that you create, and then extract that table using one of the techniques
you’ve seen so far. Let’s briefly walk through an example of this technique. You can easily find
the current database name with the following query:
SELECT database()
The files for this database will be stored in a directory with the same name as the
database itself. This directory will be contained in the main MySQL data directory, which is
returned by the following query:
SELECT @@datadir