SQL Injection · passage 43 of 186

DB2 Injection: DB2 Methodology

Text · SQL Injection/DB2 Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

| Description | SQL Query | | -------------- | ------------------------------------------------------------ | | List databases | `SELECT distinct(table_catalog) FROM sysibm.tables` | | List databases | `SELECT schemaname FROM syscat.schemata;` | | List columns | `SELECT name, tbname, coltype FROM sysibm.syscolumns` | | List tables | `SELECT table_name FROM sysibm.tables` | | List tables | `SELECT name FROM sysibm.systables` | | List tables | `SELECT tbname FROM sysibm.syscolumns WHERE name='username'` |

Every one of the 186 is a mark on the map. Named now: 27 to 52, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.