This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "SQL Injection Cookbook template"
From OWASP
| Line 15: | Line 15: | ||
=System data= | =System data= | ||
==Users== | ==Users== | ||
| + | ===Identify current user=== | ||
===List of database users=== | ===List of database users=== | ||
===List of database administrators=== | ===List of database administrators=== | ||
| Line 27: | Line 28: | ||
===OS environment variables=== | ===OS environment variables=== | ||
===Execute OS shell commands=== | ===Execute OS shell commands=== | ||
| + | ===Read file contents=== | ||
| + | ===Arbitrary file writes=== | ||
| + | ===File uploads=== | ||
| − | =Queries= | + | =Unique database server features= |
| − | ==Valid string delimiters== | + | |
| + | =Queries, attacks & filter evasions= | ||
| + | ==Strings | ||
| + | ===Valid string delimiters=== | ||
| + | ===String concatenation=== | ||
| + | ===String-based queries with no quote characters=== | ||
| + | ==Tableless queries== | ||
==Query comments== | ==Query comments== | ||
==Query command delimiters== | ==Query command delimiters== | ||
==Data type casting== | ==Data type casting== | ||
| − | == | + | ==Output to file== |
| + | ==Timing attacks== | ||
| + | |||
| + | =Data exfiltration= | ||
| + | ==E-mail== | ||
| + | ==Web== | ||
| + | ==General network== | ||
Revision as of 20:23, 13 January 2007
Database objects
Tables
List of table names
Create a table
List of columns for a specific table
View table permissions
Change table permissions
Stored Procedures
List of stored procedures or functions
Parameters for a stored procedure or function
Source code of a stored procedure or function
Create a stored procedure or function
System data
Users
Identify current user
List of database users
List of database administrators
Database user permissions
Create a new user
Change a user password
Settings
View database server settings
Change database server settings
Host Operating System
Operating System version
OS environment variables
Execute OS shell commands
Read file contents
Arbitrary file writes
File uploads
Unique database server features
Queries, attacks & filter evasions
==Strings
