Comprehensive SQL Injection Cheat Sheet


A reader e-mailed me a while ago about a fairly comprehensive SQL Injection Cheat Sheet they had created and posted up.

Comprehensive SQL Injection Cheat Sheet


I compared it to the other ones I had bookmarked, and it was different enough to be worth posting.

Currently only for MySQL and Microsoft SQL Server, some ORACLE and some PostgreSQL. Most of samples are not correct for every single situation. Most of the real world environments may change because of parenthesis, different code bases and unexpected, strange SQL sentences.

Samples are provided to allow reader to get basic idea of a potential attack and almost every section includes a brief information about itself.

SQL Injection Cheat Sheet

It’s worthy resource to save on your hacking pen-drive and bookmark in your portable Firefox.

https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/

Posted in: Database Hacking

, , ,


Latest Posts:


APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.


6 Responses to Comprehensive SQL Injection Cheat Sheet

  1. backbone June 5, 2007 at 7:44 am #

    it’s a great cheat sheet, but it very heavely based on sql and ms sql servers… the most killer stuff (chapter 12) has only 2-3 sub chapters where there are discused also mysql injection codes… but if you need sql and ms sql injection codes, this is the best that I have seen… it’s also the first when you search on google “sql injection cheat sheet” :)

  2. Torvaun June 5, 2007 at 8:20 am #

    Excellent, one more resource that I didn’t already have in quality. Darknet strikes again!

  3. Daniel June 5, 2007 at 10:10 pm #

    I actually learned how to do manual SQL injections from this thing and the links provided. like 3 months ago maybe.

    Its sweet.

    I just copied and pasted code, then started to understand it.

  4. J. Lion February 12, 2008 at 6:34 pm #

    Good Resource (bookmarked)

  5. Pantagruel February 13, 2008 at 1:45 am #

    Indeed a very nice cheat sheet. Am not really into databse pentesting, but we will have a shake down of an in-house generated db soon. Guess I’ll have to check this cheat sheet and do some trying.

  6. eM3rC February 13, 2008 at 2:40 am #

    Bookmarked and on my list of things to study.

    @Pantagruel
    If you decided to become a black hat I bet all hell would break loose ;P