Ethical Hacking and Penetration Testing Guide

Syntax
http://localhost/index.php?support=yes’ and (SELECT 1 from dvwa.users limit 0,1)=1--+
Guessing Columns in the Table
Now that we have found that the users table exists inside the database, the next step would be to 
determine the columns in the table, for which we will use the following query:
Syntax
http://localhost/index.php?support=yes’ and (SELECT substring(concat(1,username),1,1) from 
dvwa.users limit 0,1)=1--+
All you need to do now is replace the word “username” with the column you are trying to guess 
from the query. Let’s see what happens when we execute this query.

---

360
◾ 
Ethical Hacking and Penetration Testing Guide
The application returns an error indicating that the column “username” does not exist in the 
“users” table present in the dvwa database. Let’s now try injecting a column that is present in the 
table.
Syntax
http://localhost/index.php?support=yes’ and (SELECT substring(concat(1,user),1,1) from dvwa.
users limit 0,1)=1--+
It results in a true statement. In a similar manner, we can try guessing other columns as well.
Extracting Data from Columns
Now comes the hard part: figuring out the contents in the column user. We would need to do it 
one character at a time. Let’s take a look at the command:
Syntax
http://localhost/index.php?support=yes’ and (select mid(user,1,1) from dvwa.users limit 0,1)=’a’--+
This query is simply asking the database if the first character of the user is “a”.
We get a true response meaning that it’s indeed “a”. From the previous UNION-based SQL 
injection demonstration, we already know that it’s 
admin
; however, you can look at how time con-
suming this can be when we are enumerating one character a time. There are additional techniques 
used by scanners where it compares the ascii values and asks questions to the database if the ascii 
value of the character is greater or lesser than the value we are trying to guess. In this way, scanners 
can perform this task a bit faster.

---

Web Hacking
◾