SQL Injection Attacks and Defense - 2009

References • Chapter 10 451
Informix Cheat Sheet
The Informix database server is distributed by IBM and is not commonly encountered
when compared to other database platforms. The following reference should help if you
encounter an Informix server in the wild.
Enumerating Database
Configuration Information and Schema
Table 10.27 lists SQL statements used to extract key configuration information. Table 10.28
lists the SQL statements used to enumerate schema information.
Table 10.27 Extracting Informix Database Configuration Information
Data
Version
Query
SELECT DBINFO('version', 'full') FROM systables WHERE
tabid = 1;
Current user SELECT USER FROM systables WHERE tabid = 1;
List users
Current user
privileges
Database server
host name
select usertype,username, password from sysusers;
select tabname, tabauth, grantor, grantee FROM
systabauth join systables on systables.tabid =
systabauth.tabid
SELECT DBINFO('dbhostname') FROM systables WHERE
tabid=1;
Table 10.28 Extracting Informix Database Schema
Data
Query
Current database SELECT DBSERVERNAME FROM systables WHERE tabid = 1;
List databases
List tables
SELECT name, owner FROM sysdatabases;
SELECT tabname FROM systables;
List columns
SELECT tabname, viewtext FROM sysviews join systables
on systables.tabid = sysviews.tabid;
SELECT tabname, colname, coltype FROM
syscolumns join systables on syscolumns.tabid =
systables.tabid;