From c3af630e1d2c3f816d79757729f9327dd37e05d5 Mon Sep 17 00:00:00 2001 From: Mark <148797232+MarkCyber@users.noreply.github.com> Date: Sun, 26 May 2024 10:40:54 -0400 Subject: [PATCH] Update README.md --- SQL Injection/README.md | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/SQL Injection/README.md b/SQL Injection/README.md index 6fd6db7..b24e75e 100644 --- a/SQL Injection/README.md +++ b/SQL Injection/README.md @@ -136,19 +136,18 @@ Detection of an SQL injection entry point ## DBMS Identification VIA Error -When testing for SQL injection error messages can also help in identifying the underlying DBMS: - -| DBMS | Example Error Message | Example Payload | -|---------------------|------------------------------------------------------------------------------------------------------------ -| MySQL | `You have an error in your SQL syntax; ... near '' at line 1` | `'` | -| PostgreSQL | `ERROR: unterminated quoted string at or near "'"` | `'` | -| PostgreSQL | `ERROR: syntax error at or near "1"` | `1'` | -| Microsoft SQL Server| `Unclosed quotation mark after the character string ''.` | `'` | -| Microsoft SQL Server| `Incorrect syntax near ''.` | `'` | -| Microsoft SQL Server| `The conversion of the varchar value to data type int resulted in an out-of-range value.` | `1'` | -| Oracle | `ORA-00933: SQL command not properly ended` | `'` | -| Oracle | `ORA-01756: quoted string not properly terminated` | `'` | -| Oracle | `ORA-00923: FROM keyword not found where expected` | `1'` | +DBMS | Example Error Message | Example Payload | +|---------------------|------------------------------------------------------------------------------------------|-----------------| +| MySQL | `You have an error in your SQL syntax; ... near '' at line 1` | `'` | +| PostgreSQL | `ERROR: unterminated quoted string at or near "'"` | `'` | +| PostgreSQL | `ERROR: syntax error at or near "1"` | `1'` | +| Microsoft SQL Server| `Unclosed quotation mark after the character string ''.` | `'` | +| Microsoft SQL Server| `Incorrect syntax near ''.` | `'` | +| Microsoft SQL Server| `The conversion of the varchar value to data type int resulted in an out-of-range value.`| `1'` | +| Oracle | `ORA-00933: SQL command not properly ended` | `'` | +| Oracle | `ORA-01756: quoted string not properly terminated` | `'` | +| Oracle | `ORA-00923: FROM keyword not found where expected` | `1'` | +------------------------------------------------------------------------------------------------------------------------------------ ## SQL injection using SQLmap