A curated, comprehensive compilation of over 900+ SQL Injection (SQLi) payloads designed for security research, penetration testing, Web Application Firewall (WAF) evasion testing, and vulnerability assessment.
Warning
Disclaimer: This repository and the payloads contained herein are intended solely for educational, research, and authorized penetration testing purposes. Using these payloads against systems without explicit, written consent from the owner is illegal and punishable by law. The author assumes no responsibility for any misuse or damage caused by these materials.
payloads.txt: The main wordlist containing various SQL injection payloads categorized by type (Auth bypass, Union based, Time-based blind, Error-based, etc.).README.md: Project documentation and guidelines.LICENSE: MIT License.
The payloads.txt file contains standard and advanced techniques, including:
- Authentication Bypass: Classic
' OR '1'='1variants and comment-based bypasses. - UNION-Based: Payloads for schema and data extraction via union queries.
- Error-Based: Database-specific error trigger functions (MySQL, PostgreSQL, MS SQL, Oracle).
- Time-Based Blind: Sleep and benchmark payloads to detect blind vulnerabilities.
- Inline Comments & Obfuscation: Bypass techniques using spaces, hex encoding, and SQL-specific comment markers (
/**/,/*!50000...*/).
These payloads can be integrated into popular security auditing tools:
- OWASP ZAP or Burp Suite (using the Fuzzer / Intruder tool).
- SQLMap (for custom dictionary attacks).
- Custom Python/Bash automation scripts to test WAF rule robustness.
Contributions are welcome! If you have new payloads, bypass techniques, or improvements:
- Fork the repository.
- Create a branch (
git checkout -b feature/new-payloads). - Add your payloads to
payloads.txt. - Commit your changes and open a Pull Request.
This repository is licensed under the MIT License. See the LICENSE file for details.