You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: _sources/database/sqlite.rst.txt
+73
Original file line number
Diff line number
Diff line change
@@ -30,6 +30,7 @@ From the interactive prompt given by ``sqlite3``, it is possible to run SQL stat
30
30
31
31
# Show the version
32
32
.version
33
+
SELECT SQLITE_VERSION();
33
34
34
35
# Quit
35
36
.exit
@@ -94,3 +95,75 @@ For example:
94
95
.. code-block:: sql
95
96
96
97
SELECT DATETIME(users.last_update_time, 'unixepoch') FROM users;
98
+
99
+
Schema table
100
+
------------
101
+
102
+
According to the `documentation <https://www.sqlite.org/schematab.html>`_, every SQLite database contains a single "schema table" named ``sqlite_master`` that stores the schema for that database.
103
+
104
+
.. code-block:: sql
105
+
106
+
sqlite> .schema sqlite_master
107
+
CREATE TABLE sqlite_master (
108
+
type text,
109
+
name text,
110
+
tbl_name text,
111
+
rootpage integer,
112
+
sql text
113
+
);
114
+
115
+
To understand its content in actual database, let's create a new table in an empty database.
116
+
117
+
.. code-block:: sql
118
+
119
+
DROP TABLE IF EXISTS `users`;
120
+
CREATE TABLE IF NOT EXISTS `users` (
121
+
`uid` INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
122
+
`name` TEXT NOT NULL,
123
+
`email` VARCHAR(255) UNIQUE NOT NULL,
124
+
`password` VARCHAR(110) NOT NULL,
125
+
`admin` TINYINT(1) NOT NULL DEFAULT '0',
126
+
`created` DATETIME NOT NULL
127
+
);
128
+
129
+
After executing these statements, the schema table contains the ``CREATE TABLE`` statement and other objects:
To exfiltrate the characters of such a string, functions ``HEX``, ``SUBSTR`` and ``LENGTH`` (documented in `Built-In Scalar SQL Functions <https://sqlite.org/lang_corefunc.html>`_) can be used.
<h2>Schema table<aclass="headerlink" href="#schema-table" title="Permalink to this headline">¶</a></h2>
127
+
<p>According to the <aclass="reference external" href="https://www.sqlite.org/schematab.html">documentation</a>, every SQLite database contains a single “schema table” named <codeclass="docutils literal notranslate"><spanclass="pre">sqlite_master</span></code> that stores the schema for that database.</p>
<p>After executing these statements, the schema table contains the <codeclass="docutils literal notranslate"><spanclass="pre">CREATE</span><spanclass="pre">TABLE</span></code> statement and other objects:</p>
151
+
<divclass="highlight-text notranslate"><divclass="highlight"><pre><span></span>sqlite> SELECT * FROM sqlite_master;
<p>From a SQL injection vulnerability, this table can be obtained using queries such as:</p>
165
+
<divclass="highlight-sql notranslate"><divclass="highlight"><pre><span></span><spanclass="c1">-- Concatenate all fields and select the 1st entry (using COALESCE to support NULL values)</span>
<p>To exfiltrate the characters of such a string, functions <codeclass="docutils literal notranslate"><spanclass="pre">HEX</span></code>, <codeclass="docutils literal notranslate"><spanclass="pre">SUBSTR</span></code> and <codeclass="docutils literal notranslate"><spanclass="pre">LENGTH</span></code> (documented in <aclass="reference external" href="https://sqlite.org/lang_corefunc.html">Built-In Scalar SQL Functions</a>) can be used.
0 commit comments