Skip to content
BackEsc
Sign in

SQL Injection · payload topic

SQL Injection

186 passages · 149 code blocks

Every mark is a titled passage of this topic's pages, in reading order; the brighter ones carry code. For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open SQL Injection on GitHub

SQL Injection (SQLi) is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. SQL Injection is one of the most common and severe types of web application vulnerabilities, enabling attackers to execute arbitrary SQL code on…

Source: PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 105 to 130, reading order first.

  1. MySQL Injection: MYSQL Truncation§ 1051 code block · MySQL Injection.md
  2. MySQL Injection: MYSQL Out of Band§ 1061 code block · MySQL Injection.md
  3. MySQL Injection: DNS Exfiltration§ 1071 code block · MySQL Injection.md
  4. MySQL Injection: UNC Path - NTLM Hash Stealing§ 1081 code block · MySQL Injection.md
  5. MySQL Injection: Alternative to Information Schema§ 1091 code block · MySQL Injection.md
  6. MySQL Injection: Alternative to VERSION§ 1101 code block · MySQL Injection.md
  7. MySQL Injection: Alternative to GROUPCONCAT§ 1111 code block · MySQL Injection.md
  8. MySQL Injection: Scientific Notation§ 112text · MySQL Injection.md
  9. MySQL Injection: Conditional Comments§ 113text · MySQL Injection.md
  10. MySQL Injection: Wide Byte Injection (GBK)§ 1142 code blocks · MySQL Injection.md
  11. OracleSQL Injection: Oracle SQL Injection§ 115text · OracleSQL Injection.md
  12. OracleSQL Injection: Oracle SQL Default Databases§ 116text · OracleSQL Injection.md
  13. OracleSQL Injection: Oracle SQL Comments§ 117text · OracleSQL Injection.md
  14. OracleSQL Injection: Oracle SQL Enumeration§ 118text · OracleSQL Injection.md
  15. OracleSQL Injection: Oracle SQL Database Credentials§ 119text · OracleSQL Injection.md
  16. OracleSQL Injection: Oracle SQL List Databases§ 1201 code block · OracleSQL Injection.md
  17. OracleSQL Injection: Oracle SQL List Tables§ 1211 code block · OracleSQL Injection.md
  18. OracleSQL Injection: Oracle SQL List Columns§ 1221 code block · OracleSQL Injection.md
  19. OracleSQL Injection: Oracle SQL Error Based§ 123text · OracleSQL Injection.md
  20. OracleSQL Injection: Oracle SQL Blind§ 124text · OracleSQL Injection.md
  21. OracleSQL Injection: Oracle Blind With Substring Equivalent§ 125text · OracleSQL Injection.md
  22. OracleSQL Injection: Oracle SQL Time Based§ 1261 code block · OracleSQL Injection.md
  23. OracleSQL Injection: Oracle SQL Out of Band§ 1271 code block · OracleSQL Injection.md
  24. OracleSQL Injection: Oracle SQL Command Execution§ 128text · OracleSQL Injection.md
  25. OracleSQL Injection: Oracle Java Execution§ 129text · OracleSQL Injection.md
  26. OracleSQL Injection: Oracle Java Class§ 130text · OracleSQL Injection.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in