Comprehensive SQL Injection Cheat Sheet


A reader e-mailed me a while ago about a fairly comprehensive SQL Injection ‘Cheat Sheet’ they had created and posted up.

I compared it to the other ones I had bookmarked, and it was different enough to be worth posting.

Currently only for MySQL and Microsoft SQL Server, some ORACLE and some PostgreSQL. Most of samples are not correct for every single situation. Most of the real world environments may change because of parenthesis, different code bases and unexpected, strange SQL sentences.

Samples are provided to allow reader to get basic idea of a potential attack and almost every section includes a brief information about itself.

It’s worthy resource to save on your Hacking pendrive and bookmark in your portable Firefox.

http://ferruh.mavituna.com/makale/sql-injection-cheatsheet/

Posted in: Database Hacking, Web Hacking

, , ,


Latest Posts:


SecLists - Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.
DeepSound - Audio Steganography Tool DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files.
2019 High Severity Vulnerabilities What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization?
GoBuster - Directory/File & DNS Busting Tool in Go GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool.
BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.


6 Responses to Comprehensive SQL Injection Cheat Sheet

  1. backbone June 5, 2007 at 7:44 am #

    it’s a great cheat sheet, but it very heavely based on sql and ms sql servers… the most killer stuff (chapter 12) has only 2-3 sub chapters where there are discused also mysql injection codes… but if you need sql and ms sql injection codes, this is the best that I have seen… it’s also the first when you search on google “sql injection cheat sheet” :)

  2. Torvaun June 5, 2007 at 8:20 am #

    Excellent, one more resource that I didn’t already have in quality. Darknet strikes again!

  3. Daniel June 5, 2007 at 10:10 pm #

    I actually learned how to do manual SQL injections from this thing and the links provided. like 3 months ago maybe.

    Its sweet.

    I just copied and pasted code, then started to understand it.

  4. J. Lion February 12, 2008 at 6:34 pm #

    Good Resource (bookmarked)

  5. Pantagruel February 13, 2008 at 1:45 am #

    Indeed a very nice cheat sheet. Am not really into databse pentesting, but we will have a shake down of an in-house generated db soon. Guess I’ll have to check this cheat sheet and do some trying.

  6. eM3rC February 13, 2008 at 2:40 am #

    Bookmarked and on my list of things to study.

    @Pantagruel
    If you decided to become a black hat I bet all hell would break loose ;P