SQL Injection Payload Generator

SQL injection in CTF challenges

SQL injection (SQLi) is consistently one of the most tested vulnerability categories in picoCTF and similar competitions. The root cause is always the same: user-supplied input is concatenated directly into a SQL query string instead of being passed as a bound parameter. The database then executes the attacker input as SQL syntax.

Auth bypass is the entry point for most beginner challenges. Entering a payload like ' OR 1=1-- - as the username makes the WHERE clause always true, granting login without a valid password. The -- - comments out the rest of the query including the password check.

UNION extraction appends a second SELECT to the original query and injects its output into the page. You first probe the column count with ORDER BY, find which column reflects to the page, then use that position to pull table names, column names, and finally the flag data.

Blind injection applies when query results are never echoed. Boolean-based blind injection compares two response shapes (one with a true condition, one with false) to infer character values one at a time. Time-based blind injection uses SLEEP() or equivalent to signal true/false via response delay. Both techniques are tedious to run manually; sqlmap automates them.

NoSQL injection targets document stores like MongoDB. Instead of SQL syntax, you inject query operators ( $ne, $gt, $regex) when the server deserializes the POST body directly into a query object without validation.

For a full technique walkthrough with picoCTF challenge examples at every level, see the SQL Injection for CTF guide.