# SecLists Payload Collections for SQL Injection Testing: A Complete Guide

> Master SQL injection testing with SecLists payload collections. Explore database-specific and generic payloads for thorough security assessments. Download the best resources now.

- Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists)
- Tags: tutorial
- Published: 2026-03-03

---

**SecLists provides modular SQL injection testing payloads in `Fuzzing/Databases/SQLi/` with database-specific files like [`MySQL.fuzzdb.txt`](https://github.com/danielmiessler/SecLists/blob/main/MySQL.fuzzdb.txt) and generic collections like [`Generic-SQLi.txt`](https://github.com/danielmiessler/SecLists/blob/main/Generic-SQLi.txt) for comprehensive security assessments.**

The **danielmiessler/SecLists** repository serves as the industry-standard collection of security testing wordlists. Its SQL injection payload collections reside in the `Fuzzing/Databases/SQLi/` directory, offering ready-to-use attack vectors for union-based, blind time-based, error-based, and NoSQL injection scenarios against diverse database management systems.

## Directory Structure and Core Files

The repository organizes injection vectors hierarchically under `Fuzzing/Databases/SQLi/`, separating database-agnostic payloads from DBMS-specific exploit strings.

### Generic and Cross-Platform Payloads

Several files contain universal attack patterns effective across multiple relational databases:

- **Generic-SQLi.txt** (≈300 lines): Classic union-based, error-based, and comment-injection strings compatible with MySQL, PostgreSQL, MSSQL, Oracle, and SQLite.
- **Generic-BlindSQLi.txt**: Time-based blind SQL injection payloads for detecting vulnerabilities when verbose error messages are suppressed.
- **SQLi-Polyglots.txt**: Multi-database payloads engineered to execute successfully across disparate DBMS engines without modification.
- **quick-SQLi.txt** (≈30 lines): Abbreviated sanity-check list for rapid initial reconnaissance.

### Database-Specific Collections

Targeted payloads follow the [`.fuzzdb.txt`](https://github.com/danielmiessler/SecLists/blob/main/.fuzzdb.txt) naming convention originally established by the FuzzDB project:

- **MySQL.fuzzdb.txt**: MySQL-specific vectors including `UNION SELECT ... INTO OUTFILE` syntax and file-read operations.
- **MSSQL.fuzzdb.txt**: Microsoft SQL Server payloads featuring `; EXEC xp_cmdshell` and privilege escalation techniques.
- **NoSQL.txt**: Injection vectors targeting MongoDB, CouchDB, and other document-oriented databases.

Adjacent directories contain specialized resources:
- [`Fuzzing/Databases/MySQL-Read-Local-Files.fuzzdb.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/Databases/MySQL-Read-Local-Files.fuzzdb.txt): File-read specific payloads for MySQL backends.
- [`Fuzzing/Databases/MSSQL-Enumeration.fuzzdb.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/Databases/MSSQL-Enumeration.fuzzdb.txt): Enumeration helpers for MSSQL environments.

## Integration with Security Testing Tools

All payload files utilize plain UTF-8 encoding with LF line terminators, enabling seamless integration with command-line tools and commercial scanners.

### Web Fuzzing with ffuf

Pipe payload files directly into fuzzing operations using the `FUZZ` keyword:

```bash
ffuf -u "http://target.com/search?q=FUZZ" \
     -w /path/to/SecLists/Fuzzing/Databases/SQLi/Generic-SQLi.txt \
     -mc 200,500

```

This configuration tests each line from [`Generic-SQLi.txt`](https://github.com/danielmiessler/SecLists/blob/main/Generic-SQLi.txt) against the `q` parameter while matching HTTP 200 and 500 status codes.

### Burp Suite Automation

Prepare payloads for Burp Intruder using Python to generate compatible CSV imports:

```python
import csv
import os

payload_path = os.path.expanduser("~/SecLists/Fuzzing/Databases/SQLi/quick-SQLi.txt")
with open(payload_path) as f:
    payloads = [line.strip() for line in f if line.strip()]

with open('burp_payloads.csv', 'w', newline='') as csvfile:
    writer = csv.writer(csvfile)
    for p in payloads:
        writer.writerow([p])

```

Import `burp_payloads.csv` into Burp Intruder via **Payloads → Load** to execute the quick-test sequence.

### Command-Line Verification

Execute rapid manual checks using standard shell loops:

```bash
while read -r payload; do
    curl -s "http://target.com/login?user=admin&pass=${payload}"
done < SecLists/Fuzzing/Databases/SQLi/Generic-SQLi.txt

```

This loop transmits each payload as the `pass` parameter while suppressing response output (`-s`).

## Payload Maintenance and Validation

The repository includes helper utilities in `.bin/` to ensure wordlist integrity and consistency.

### Validating Wordlists with validators.py

The [`.bin/validators.py`](https://github.com/danielmiessler/SecLists/blob/main/.bin/validators.py) script performs automated quality assurance:

```bash
python3 SecLists/.bin/validators.py \
    -i SecLists/Fuzzing/Databases/SQLi/Generic-SQLi.txt \
    -o valid_sql_payloads.txt

```

According to the source implementation, this utility removes duplicate entries, trims whitespace, and enforces a default 200-byte length limit per payload, ensuring compatibility with restrictive input fields.

## Summary

- The `Fuzzing/Databases/SQLi/` directory structure organizes payloads by database type and attack methodology.
- **Generic-SQLi.txt** provides cross-platform coverage while [`.fuzzdb.txt`](https://github.com/danielmiessler/SecLists/blob/main/.fuzzdb.txt) files offer DBMS-specific exploits for MySQL, MSSQL, and NoSQL targets.
- Plain-text formatting enables immediate integration with **ffuf**, **Burp Suite**, **sqlmap**, and custom automation scripts.
- The [`.bin/validators.py`](https://github.com/danielmiessler/SecLists/blob/main/.bin/validators.py) utility maintains payload quality through deduplication and length validation.
- All collections are distributed under the **MIT License** within the **danielmiessler/SecLists** repository.

## Frequently Asked Questions

### What is the difference between Generic-SQLi.txt and quick-SQLi.txt?

[`Generic-SQLi.txt`](https://github.com/danielmiessler/SecLists/blob/main/Generic-SQLi.txt) contains approximately 300 comprehensive payloads covering union-based, error-based, and boolean-based techniques across multiple database systems. [`quick-SQLi.txt`](https://github.com/danielmiessler/SecLists/blob/main/quick-SQLi.txt) provides a curated subset of roughly 30 high-probability strings designed for rapid initial reconnaissance when testing time is constrained or when verifying basic vulnerability presence before deep fuzzing.

### How do I use SecLists SQL injection payloads with sqlmap?

While sqlmap generates its own injection vectors, you can leverage SecLists to enhance targeted testing. Extract specific strings from [`MySQL.fuzzdb.txt`](https://github.com/danielmiessler/SecLists/blob/main/MySQL.fuzzdb.txt) or [`MSSQL.fuzzdb.txt`](https://github.com/danielmiessler/SecLists/blob/main/MSSQL.fuzzdb.txt) and reference them via sqlmap's `--string` or `--regexp` options to confirm specific database contexts, or incorporate them into custom tamper scripts placed in sqlmap's `tamper/` directory.

### Are the SQL injection payloads in SecLists legal to use?

Yes, the repository is released under the **MIT License**, permitting unrestricted use, modification, and distribution for legitimate security testing. However, these payloads must only be deployed against systems you own or have explicit written authorization to test. Unauthorized use against third-party systems may violate computer fraud and abuse statutes.

### Does SecLists include payloads for NoSQL injection testing?

Yes, the repository includes [`Fuzzing/Databases/SQLi/NoSQL.txt`](https://github.com/danielmiessler/SecLists/blob/main/Fuzzing/Databases/SQLi/NoSQL.txt), which contains specialized vectors targeting MongoDB, CouchDB, and other non-relational databases. These payloads exploit NoSQL-specific syntax patterns, such as JavaScript injection in MongoDB queries or alternative operators in JSON-based APIs, distinct from traditional SQL injection techniques.