SQL injection/Target Environments/Mapping

Nearly every modern databasing engine has an information_schema database or schema. Important tables that are part of information_schema include schemata, routines, columns, and tables.

MySQL database mapping

When outside of the C SQL API, access the data structure via the information_schema database.

• Show Databases equivalent:

SELECT schema_name FROM information_schema.schemata;

• Show tables equivalent:

SELECT TABLE_NAME FROM information_schema.tables WHERE table_schema=[database_name]

• Show fields equivalent:

SELECT column_name FROM information_schema.columns WHERE TABLE_NAME=[TABLE_NAME] AND table_schema=[database_name]

If the currently selected database is the only accessible database in the context of the vulnerable query, time can be saved by using the database() function or @@database environment variables, e.g. where table_schema = database() or where table_schema = @@database.

PostgreSQL mapping

PostgreSQL has the current_database() function in stead of the database() function.

• \dn equivalent:

SELECT schema_name FROM information_schema.schemata WHERE catalog_name=[DATABASE name]

• \dt equivalent:

SELECT TABLE_NAME FROM information_schema.tables table_type='BASE TABLE' AND table_schema=([schema_query]) AND catalog_name=[DATABASE name]

• \d [column_name] equivalent:

SELECT column_name FROM information_schema.columns WHERE TABLE_NAME=([table_query]) AND table_schema=([schema_query]) AND catalog_name=[database_name]

MS SQL mapping

An important note is that MS SQL is different when it comes to ordered single-cell selection.

Notice: We don't currently have a method of listing all of the database names in MS SQL. If you have a copy that one of the developers can use for testing to improve this article, please don't hesitate to let us know in IRC.

• Listing Tables:

SELECT TABLE_NAME FROM information_schema.columns WHERE table_catalog=[database_name] GROUP BY TABLE_NAME ORDER BY TABLE_NAME ASC;

• Listing Columns:

SELECT column_name FROM information_schema.columns WHERE table_catalog=[database_name] AND TABLE_NAME=[table_query] GROUP BY column_name ORDER BY column_name ASC

Legacy databases

The information_schema database entered the open source community in MySQL version 5 and at the end of PostgreSQL Version 7.3; old and current versions of SQL engines contain their schema information in their administration databases. More information can be found on this by combining techniques listed here with the manuals and documentation.

Access/MSSQL sysobjects table/database (Legacy Access/Jet Engine) msysobjects table/database (Legacy SQL Server CE)

PROCEDURE ANALYSE might come in handy.

MySQL 4 MySQL.columns_priv MySQL.tables_priv MySQL.db

It is typical that legacy database versions require privileged access for flexible mapping.