SQL injection attack, listing the database contents on non-Oracle databases (Video solution, Audio)

preview_player
Показать описание
This video shows the lab solution of "SQL injection attack, listing the database contents on non-Oracle databases " from Web Security Academy (Portswigger)

Рекомендации по теме
Комментарии
Автор

why isnt column_name in the cheat_sheet ?

jeremiasm
Автор

Hello Michael,
I have a question regarding the query which returns information_schema.tables. I was not able to find out anywhere else, so I am going to ask you.

Why do we have to use table_name, NULL in this query? I can not comprehend, why we have to use table_name instead of *. For the life of me, I can not figure this out. I am not talking about the NULL part of the query. I understand that. What I am asking about is using a direct parameter (table_name) over the wildcard character (*).

Thanks a lot for the answer.

slavicslav