SQL Injection Attacks and Defense - 2009

180 Chapter 4 • Exploiting SQL Injection
Each table of the database is contained in a file with the extension MYD. For instance,
here are some of the MYD files of a default mysql database:
tables_priv.MYD
host.MYD
help_keyword.MYD
columns_priv.MYD
db.MYD
You can extract the contents of a specific table of that database with the following query:
SELECT load_file('databasename/tablename.MYD')
However, without information_schema you will have to brute-force the table name for this
query to succeed. Also, note that load_file (discussed in more detail in Chapter 6) only allows
you to retrieve a maximum number of bytes that is specified in the @@max_allowed_packet
variable, so this technique is not suited for tables that store large amounts of data.
Oracle
The last example we will cover is how to enumerate the database schema when the back-end
DBMS is Oracle. An important fact to remember when using Oracle is that you will
normally be accessing only one database at a time, as databases in Oracle are normally
accessed via a specific connection, and multiple databases accessed by an application will
generally have different connections. Therefore, unlike SQL Server and MySQL, you won’t be
enumerating the databases present when finding the database schema.
The first thing you may be interested in is the list of tables that belong to the current
user. In the context of an application, this will generally be the application tables in the
database:
select table_name from user_tables;
You can extend this to look at all of the tables in the database and their owners:
select owner,table_name from all_tables;
You can enumerate some more information about your application tables to determine
the number of columns and rows that are present in the tables as follows:
select a.table_name||'['||count(*)||']='||num_rows from user_tab_columns a,
user_tables b where a.table_name=b.table_name group by
a.table_name,num_rows
EMP[8]=14
DUMMY[1]=1
DEPT[3]=4
SALGRADE[3]=5