> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/sql-injection/lab-6.md).

# Lab 6

Once you have a working UNION injection, you can use it to fingerprint the database — figure out what type and version it is. This matters because different databases have different syntax for the next steps.\
\
The queries

| Database           | Query                     |
| ------------------ | ------------------------- |
| MySQL / SQL Server | `SELECT @@version`        |
| PostgreSQL         | `SELECT version()`        |
| Oracle             | `SELECT * FROM v$version` |

This matters because once you know the version you can exploit certain features

MySQL → use information\_schema to find tables 

Oracle → use all\_tables / all\_columns SQL Server → use information\_schema or sys.tables PostgreSQL → use information\_schema

<figure><img src="/files/FCn2Jxu9sT1HidVc0JXe" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/nwsoPTCyUFkGH6cYLZs7" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/PSEyECURYHsagkQsjyhL" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/PUU3HrK03FcueHmM5SwX" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/aFvSvMga2Vz4Tpdus4nl" alt=""><figcaption></figcaption></figure>