I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS.

I am in the process of writing an sql injection tool from scratch, but I am having problems finding a way/number of ways of fingerprinting the DBMS reliably. (I am aware that there are lots of excellent tools out there already, but for this project it needs to be written from scratch).

Doing this manually:

Fingerprinting the DBMS manually is a lot easier as it's easier to observe the changes and behaviour of the page, however when trying to do this in an automated fashion with a script/program it becomes a lot more difficult to monitor the behaviour of the page.

Automating this using a scanner/fuzzer:

I am aware that one possible way is to analyse the error messages returned and see whether they contain certain error messages relating to a particular DBMS, but in instances where this is not possible I need another way of doing this.

The problem I am having:

I have also played around with string concatenation methods e.g ...

This uses the fact that different DBMS handles string concantenation with different operators. Concatentation is performed in different DBMS like:

MS SQL : 'string1' + 'string2'
MYSQL : CONCAT('string1','string2')
Oracle : 'string1' || 'string2' or CONCAT('string1','string2')

http://example/index.php?id=1+UNION+SELECT+NULL, CONCAT('sql',+'injection'),NULL,NULL  <-- MYSQL
http://www.example.com/abc.php?id=1 AND 'str1str2' ='str1'+'str2'         <-- MSSQL
http://www.example.com/abc.php?=1 AND 'str1str2'=CONCAT('str1','str2')    <-- MYSQL
http://www.example.com/abc.php?=1 AND 'str1str2'=CONCAT('str1','str2')    <-- ORACLE
http://www.example.com/abc.php?=1 AND 'str1str2'='str1'||'str2'   <-- ORACLE

I can supposedly use this method to see if the string is output on the page or if the page changes or if an error is generated...and so on

but from some testing I have done a number of these concatenation methods appear to work on a number of DBMS (e.g using the + symbol works on both MSSQL and MYSQL), which is no use when I am trying to definatively determine which DBMS it is.

Using different SQL dialect appears to be another possible method, see http://digitizor.com/2009/03/27/sql-injection-2-fingerprinting/, but I can find very little information regarding this method?

Do you know of the best/most reliable way of fingerprinting the DBMS in an automated/scripted fashion?

your help is much appreciated, thanks

  • On MySQL, 'a'+'b' is an arithmetic operation and yields 0 as neither 'a' nor 'b' are numeric.
    – Gumbo
    Commented Apr 11, 2013 at 16:32
  • 1
    You could, download a program that already includes this functionality like Havij itsecteam.com/products/havij-v116-advanced-sql-injection Then run wireshark on your NIC while it fingerprints the vulnerable database and view the requests it sends/receives.
    – NULLZ
    Commented Apr 12, 2013 at 0:16

2 Answers 2


If you like to automate fingerprinting i recommend using more than just one indicator, because sometimes it happens to be a little tricky...

Even i hate those timing attacks they are sometimes quite useful... Here another hint on different sql dialects...

(MSSQL) http://www.example.com/abc.php?id=1; waitfor delay '0:0:10'--

(MySQL) http://www.example.com/abc.php?id=1; if 1=1 BENCHMARK(1000000000,MD5(1))

(Postgre) http://www.example.com/abc.php?id=1; select pg_sleep(10);

  • Yes this would be a good way of automating fingerprinting that I had not considered, thanks
    – yonetpkbji
    Commented Apr 17, 2013 at 14:38
  • no problem... for oracle this doesn't work. afaik ora doesn't have something like sleep (without sys rights)
    – Dr.Ü
    Commented Apr 17, 2013 at 16:01

Have you considered how SQLMap does its fingerprinting? It says it uses:

error messages, banner parsing, functions output comparison and specific features such as MySQL comment injection.

  • Yes, the only real piece of detailed information I was able to find related to how SQL map does it's fingerprinting (I may be mistaken but it may have actually been written by one of the authors of SQL map), thanks for your help
    – yonetpkbji
    Commented Apr 17, 2013 at 14:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .