This is an old revision of the document!
# Tactical Fuzzing - SQLi
## SQL Injection
Core Idea: Does the page look like it might need to call on stored data?
There exist some SQLi polyglots, i.e (Mathias Karlsson):
SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/
Works in single quote context, works in double quote context, works in “straight into query” context!
You can also leverage the large database of fuzzlists from Seclists
## SQL Injection Observations Blind is predominant, Error based is highly unlikely.
'%2Bbenchmark(3200,SHA1(1))%2B'
'+BENCHMARK(40000000,SHA1(1337))+'
SQLMap is king! - Use -l to parse a Burp log file. - Use Tamper Scripts for blacklists. - SQLiPy Burp plugin works well to instrument SQLmap quickly. Lots of injection in web services!
## Best SQL injection resources
- MySQL:
- MSSQL:
- ORACLE:
- POSTGRESQL:
- Others