1. Understanding the Database Structure

Think of a SQL database like a filing system:

• Database: The main filing cabinet (e.g., moyin_DB).
• Tables: The folders inside the cabinet (e.g., users, products).
• Columns: The individual data fields inside a folder (e.g., user, name, pass, key).

2. The Role of information_schema

Databases like MySQL have a built-in directory called information_schema that acts like a map of the entire server. It keeps track of every database, table, and column that exists.

• information_schema.tables: Use this when you want to ask, "What tables are inside this database?"
• information_schema.columns: Use this when you want to zoom in and ask, "What columns are inside this specific table?"

3. Why GROUP_CONCAT() is Used

Normally, querying information_schema returns results row by row (e.g., table names stacked vertically). Web applications often only display one line of output at a time.

• GROUP_CONCAT() takes all those separate rows and squishes them into a single, comma-separated string (e.g., users,products,orders), making it much easier to see on the page all at once.

4. Making it Work with UNION SELECT

When a website is vulnerable to SQL Injection, you can append your own query using UNION SELECT. However, SQL requires that your injected query matches the exact number of columns the original application expects.

• Example: If the original search page displays 4 columns of data, your injection needs to provide 4 values:

  ' UNION SELECT 1, 2, 3, 4 -- -

• Once you know which column number actually appears on the screen, you can replace that number with your enumeration command (like finding tables or columns) so the results get printed directly onto the webpage.

5. Step-by-Step Attack Flow

To successfully extract data from a blind or output-reflective SQL injection point, you generally follow this roadmap:

1. Count columns: Figure out how many columns the original query uses.
2. Find reflection: Figure out which of those columns actually show up on your screen.