#163·HackTools

Oracle SQLi Column Name Enumeration Miss-Written Payload

Author: papq1Created Nov 22, 2024Updated Jul 30, 2025

Hi @LasCC big appreciation for this wonderful extension.

Today I came across on a miss-written payload, which could cause people using the extension miss a valid SQLi attack. It has to do with the oracle database section, more specifically 'Column Name Enumeration' payload which does not specify the all_tab_columns table as part for the SQLi.

image

The corrected version should be: "'UNION SELECT column_name,NULL FROM all_tab_columns where table_name="X" -- -"