Skip to content

Commit

Permalink
Tweak table to escape pipe content (#1125)
Browse files Browse the repository at this point in the history
* Tweak table to escape pipe content
* Link fix
  • Loading branch information
kingthorin authored Feb 6, 2024
1 parent fed60f7 commit 0499576
Showing 1 changed file with 2 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ Based on their [blog article](https://blog.ripstech.com/2020/exploiting-hibernat
| DBMS | SQL Injection |
|------------|-----------------------------------------------------------------------|
| MySQL | `abc\' INTO OUTFILE --` |
| PostgreSQL | `$$='$$=chr(61)|| chr(0x27) and 1=pg_sleep(2)|| version()'` |
| PostgreSQL | `$$='$$=chr(61) \|\| chr(0x27) and 1=pg_sleep(2) \|\| version()'` |
| Oracle | `NVL(TO_CHAR(DBMS_XMLGEN.getxml('select 1 where 1337>1')),'1')!='1'` |
| MS SQL | `1<LEN(%C2%A0(select%C2%A0top%C2%A01%C2%A0name%C2%A0from%C2%A0users)` |

Expand All @@ -55,6 +55,6 @@ Another example would include the [Laravel Query-Builder](https://laravel.com/do

- [Wikipedia - ORM](https://en.wikipedia.org/wiki/Object-relational_mapping)
- [New Methods for Exploiting ORM Injections in Java Applications (HITB16)](https://insinuator.net/2016/06/new-methods-for-exploiting-orm-injections-in-java-applications-hitb16/)
- [HITB2016 Slides - ORM Injections in Java Applications](https://conference.hitb.org/hitbsecconf2016ams/materials/D2T2%20-%20Mikhail%20Egorov%20and%20Sergey%20Soldatov%20-%20New%20Methods%20for%20Exploiting%20ORM%20Injections%20in%20Java%20Applications.pdf)]
- [HITB2016 Slides - ORM Injections in Java Applications](https://archive.conference.hitb.org/hitbsecconf2016ams/sessions/new-methods-for-exploiting-orm-injections-in-java-applications/)
- [Fixing SQL Injection: ORM is not enough](https://snyk.io/blog/sql-injection-orm-vulnerabilities/)
- [PayloadsAllTheThings - HQL Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/HQL%20Injection.md)

0 comments on commit 0499576

Please sign in to comment.