MSSQL / MYSQL / PSQL
SQL / MYSQL cheat sheet
01. MSSQL [1433]
01.0 Basics
## ------------------| Connection
#### Linux
impacket-mssqlclient $IP -k ## Use Kerberos authentication (requires KRB5CCNAME set)
impacket-mssqlclient <UserName>:'<Password>'@$IP
impacket-mssqlclient <Domain>/<UserName>:'<Password>'@$IP
impacket-mssqlclient <UserName>:'<Password>'@$IP -windows-auth
impacket-mssqlclient <user>@$IP -hashes <LMHASH>:<NTHASH> ## Authenticate using NTLM hashes
#### Windows
sqlcmd -U <UserName> -P '<Password>' -Q "sp_databases"
sqlcmd -U <UserName> -P '<Password>' -Q 'USE <DATABASE>; select * from users;'
## ------------------| Execute commands with impacket-mssqlclient
enable_xp_cmdshell
xp_cmdshell whoami
## ------------------| Show Database
SELECT name FROM master.dbo.sysdatabases;
SELECT name FROM sys.databases;
select name from sysdatabases;
EXEC sp_databases;
## ------------------| Use Database
USE <DB_NAME>;
## ------------------| Create Database
CREATE DATABASE <DB_NAME>;
## ------------------| List Tables
select table_name,table_schema from <DB_NAME>.INFORMATION_SCHEMA.TABLES;
SELECT name FROM <DBNAME>..sysobjects WHERE xtype = 'U';
## ------------------| List Column Names
SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'table_name');
SELECT table_name, column_name FROM information_schema.columns;
SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = '<TABLE_NAME>' ORDER BY ORDINAL_POSITION
EXEC sp_columns '<TABLE_NAME>'
## ------------------| Create Login/User & Grant Privileges
CREATE LOGIN <USER> WITH PASSWORD = '<PASSWORD>';
USE <DB_NAME>;
CREATE USER <USER> FOR LOGIN <USER>;
ALTER ROLE db_owner ADD MEMBER <USER>;
## ------------------| Create Table
CREATE TABLE employees (
id INT IDENTITY(1,1) PRIMARY KEY,
name VARCHAR(100),
age INT,
department VARCHAR(50),
salary DECIMAL(10,2)
);
## ------------------| Inserting Data
INSERT INTO employees (name, age, department, salary) VALUES ('h4rithd', 30, 'IT', 5000.00);
INSERT INTO employees (name, age, department, salary) VALUES
('Alice', 28, 'HR', 4500.00),
('Bob', 35, 'Finance', 6000.00);
## ------------------| Updating Data
UPDATE <TABLE_NAME> SET column1 = newvalue1, column2 = newvalue2 WHERE <condition>;
UPDATE employees SET salary = 7000.00 WHERE name = 'h4rithd';
## ------------------| Deleting Data
DELETE FROM employees WHERE id = 3;
DELETE FROM employees;
TRUNCATE TABLE employees;
## ------------------| Drop Table or Database
DROP TABLE <TABLE_NAME>;
DROP DATABASE <DB_NAME>;
## ------------------| Alter Table
ALTER TABLE <TABLE_NAME> ADD <COLUMN_NAME> <DATA_TYPE>;
EXEC sp_rename '<TABLE_NAME>.old_name', 'new_name', 'COLUMN';
ALTER TABLE <TABLE_NAME> ALTER COLUMN <COLUMN_NAME> <NEW_DATA_TYPE>;
ALTER TABLE <TABLE_NAME> DROP COLUMN <COLUMN_NAME>;
## ------------------| Selecting & Filtering Data
SELECT * FROM <TABLE_NAME>;
SELECT * FROM <TABLE_NAME> WHERE <condition>;
SELECT name, salary FROM employees WHERE department = 'IT';
## ------------------| Sorting Results
SELECT * FROM <TABLE_NAME> ORDER BY <COLUMN> ASC;
SELECT * FROM <TABLE_NAME> ORDER BY <COLUMN1> DESC, <COLUMN2> ASC;
## ------------------| Limiting Results
SELECT * FROM <TABLE_NAME> ORDER BY <COLUMN> OFFSET <OFFSET> ROWS FETCH NEXT <COUNT> ROWS ONLY;
## ------------------| Pattern Matching
SELECT * FROM <TABLE_NAME> WHERE <COLUMN> LIKE '%value%';
SELECT * FROM <TABLE_NAME> WHERE <COLUMN> LIKE 'value%';
SELECT * FROM <TABLE_NAME> WHERE <COLUMN> LIKE '%value';
## ------------------| Table Column Properties
PRIMARY KEY (<COLUMN>);
<COLUMN> INT NOT NULL IDENTITY(1,1);
<COLUMN> <DATA_TYPE> UNIQUE NOT NULL;
<COLUMN> <DATA_TYPE> DEFAULT GETDATE();
<COLUMN> <DATA_TYPE> NOT NULL;
## ------------------| Useful Column Enumeration
SELECT table_name, column_name
FROM information_schema.columns
WHERE column_name LIKE '%pass%'
OR column_name LIKE '%user%'
OR column_name LIKE '%username%'
OR column_name LIKE '%password%';
## ------------------| Export data
EXEC xp_cmdshell 'bcp "SELECT * FROM sysfiles" queryout "C:\dump-data.txt" -T -c -t,'
## ------------------| Search text in stored procedure in SQL Server
SELECT name FROM sys.procedures WHERE Object_definition(object_id) LIKE '%flag%';
## ------------------| Other
select name,sysadmin from syslogins;
SELECT schema_name FROM information_schema.schemata;
## ------------------| Check links
select srvname, isremote from sysservers; <-- value 1 is remote 0 is linked
exec ('select current_user') at [linkd_name];
exec ('select name,sysadmin from syslogins') at [linkd_name];
exec ('EXEC (''EXEC sp_addlogin ''''h4rithd'''', ''''harith!1'''''') at [COMPATIBILITY\POO_PUBLIC]') at [COMPATIBILITY\POO_CONFIG];
exec ('EXEC (''EXEC sp_addsrvrolemember ''''h4rithd'''', ''''sysadmin'''''') at [COMPATIBILITY\POO_PUBLIC]') at [COMPATIBILITY\EXEC POO_CONFIG];
## ------------------| Miscellaneous
SELECT COUNT(*) FROM <TABLE_NAME>;
SELECT DISTINCT <COLUMN> FROM <TABLE_NAME>;
EXEC sp_rename 'old_table', 'new_table';
SELECT * INTO backup_employees FROM employees;
## ------------------| Check IMPERSONATE permissions
SELECT pr.name AS Grantee, pr2.name AS Grantor, pe.permission_name, pe.state_desc FROM sys.server_permissions pe JOIN sys.server_principals pr ON pe.grantee_principal_id = pr.principal_id JOIN sys.server_principals pr2 ON pe.grantor_principal_id = pr2.principal_id WHERE pe.type = 'IM';
## ------------------| IMPERSONATE as other user
EXECUTE AS LOGIN = '<USERNAME>'; SELECT SUSER_NAME() AS CurrentUser; REVERT;01.1 Enumaration
01.2 Exploit
01.3 Other
02. MYSQL [3306]
02.1 Basics
02.2 Common Exploits
02.3 User-Defined Function
03. PostgreSQL [5432]
Last updated