EH-Net

I'm practicing a SQL injection on a DB and I've made some progress. When I enter:

') AND (SELECT * FROM mysql.user) -- AND (((1=1

I get: "Operand should contain 1 column(s)"

How can I get this to display on one line or something so that I can see the output from that command?

its been a while, but let me try this.

the key is to know which tables and columns are containing the information you want, you can get these by requesting the information.schema database. When you have insufficient rights to access the information.schema database you can try two things, guess the names or brute force them.

in the end you want to inject a request like this:

UNION SELECT password FROM users where login_name='admin'--

there are several good sql injection tutorials out there which you can use for more information. good luck!

This is where I'd start running "sqlmap" with a --dumpall xD

hehe, me too, hence the its been a while. i know certain challenges block such tools so being able to do it manually is a plus in that situation, in real life however...

I hadn't actually thought of sqlmap. I have it right on my desktop too.

Is --dumpall actually a switch for sqlmap?

"--dump-all", but yep! http://sqlmap.sourceforge.net/doc/README.html#s5

nah, didn't seem to work with sqlmap. Looks like I'll have to use the old fashioned way...

see if you can access the information.schema table, it will save you loads of time and helps you configure your query once you know which tables and columns you want to extract.

If I run:
') AND (select * from information_schema)-- (((1=1

I get the error "table glocken_emil.information_schema doesn't exist" so it would appear that they have appended glocken_emil to all of the tables here. I guess that tells me a little bit about the structure...

hmm, from here you can go two ways: try to guess the correct information.schema tablename (which could be glocken_emil.information_schema) or try to guess other tables like glocken_emil.users.

come to think of it, the error gets me thinking, it looks like the query is being modified to access a table with the tablename 'glocken_emil.*'. again it has been a while but you can try to use the brute forcer in sqlmap (where you define the prefix as glocken_emil) and see if you can get some tablenames.

Use "LIMIT 0,1" in the end of your original query to return only one (1) result from your "SELECT * FROM information_schema" sub-query.

Furthermore, -- (((1=1 seems incorrect.
If you break out of a query with ' (apostrophe), you could something as simple as: AND 'a'='a . That will make the end of the query look like: 'a'='a', as it will append the "missing" apostrophe.

Using a comment like -- and then adding more data afterward seems a bit obscure, because either it (or other ways like #) works or you should avoid using it.

FYI I recommend you don't just use information_schema, but more specific queries like: information_schema.tables

Just curious, is this one of the hacking-lab.com challenges?

Not that I know, as I haven't done them  ;D

Yes