MySQL table and column names (update)  January 26, 2009  While
reading at sla.ckers.org about some ways to get a SQL injection
working if your injection point is behind a “group by” and a
“limit” clause, Pragmatk came up with the PROCEDURE ANALYSE
operation (available on MySQL 3/4/5) I didnt knew of yet.
Although it didnt quite solve the actual problem, because it
seems that you cant build some dynamic parameters for the
ANALYSE function so that you could build blind SQLi vectors, it
does give you information about the used database, table and
column names of the query you are injecting to. So this is
another way of finding table and column names on MySQL without
using the information_schema tables or load_file(). Unfortunetly
you will only get the names of the columns and tables in use,
but at least it will make guessing easier or maybe some columns
are selected but not displayed by the webapp so that you can
union select them on a different position where they do get
displayed.  Here is an example: Lets ass