SecLists Payload Collections for SQL Injection Testing: A Complete Guide

SecLists provides modular SQL injection testing payloads in Fuzzing/Databases/SQLi/ with database-specific files like MySQL.fuzzdb.txt and generic collections like Generic-SQLi.txt for comprehensive security assessments.

The danielmiessler/SecLists repository serves as the industry-standard collection of security testing wordlists. Its SQL injection payload collections reside in the Fuzzing/Databases/SQLi/ directory, offering ready-to-use attack vectors for union-based, blind time-based, error-based, and NoSQL injection scenarios against diverse database management systems.

Directory Structure and Core Files

The repository organizes injection vectors hierarchically under Fuzzing/Databases/SQLi/, separating database-agnostic payloads from DBMS-specific exploit strings.

Generic and Cross-Platform Payloads

Several files contain universal attack patterns effective across multiple relational databases:

• Generic-SQLi.txt (≈300 lines): Classic union-based, error-based, and comment-injection strings compatible with MySQL, PostgreSQL, MSSQL, Oracle, and SQLite.
• Generic-BlindSQLi.txt: Time-based blind SQL injection payloads for detecting vulnerabilities when verbose error messages are suppressed.
• SQLi-Polyglots.txt: Multi-database payloads engineered to execute successfully across disparate DBMS engines without modification.
• quick-SQLi.txt (≈30 lines): Abbreviated sanity-check list for rapid initial reconnaissance.

Database-Specific Collections

Targeted payloads follow the .fuzzdb.txt naming convention originally established by the FuzzDB project:

• MySQL.fuzzdb.txt: MySQL-specific vectors including UNION SELECT ... INTO OUTFILE syntax and file-read operations.
• MSSQL.fuzzdb.txt: Microsoft SQL Server payloads featuring ; EXEC xp_cmdshell and privilege escalation techniques.
• NoSQL.txt: Injection vectors targeting MongoDB, CouchDB, and other document-oriented databases.

Adjacent directories contain specialized resources:

• Fuzzing/Databases/MySQL-Read-Local-Files.fuzzdb.txt: File-read specific payloads for MySQL backends.
• Fuzzing/Databases/MSSQL-Enumeration.fuzzdb.txt: Enumeration helpers for MSSQL environments.

Integration with Security Testing Tools

All payload files utilize plain UTF-8 encoding with LF line terminators, enabling seamless integration with command-line tools and commercial scanners.

Web Fuzzing with ffuf

Pipe payload files directly into fuzzing operations using the FUZZ keyword:

ffuf -u "http://target.com/search?q=FUZZ" \
     -w /path/to/SecLists/Fuzzing/Databases/SQLi/Generic-SQLi.txt \
     -mc 200,500

This configuration tests each line from Generic-SQLi.txt against the q parameter while matching HTTP 200 and 500 status codes.

Burp Suite Automation

Prepare payloads for Burp Intruder using Python to generate compatible CSV imports:

import csv
import os

payload_path = os.path.expanduser("~/SecLists/Fuzzing/Databases/SQLi/quick-SQLi.txt")
with open(payload_path) as f:
    payloads = [line.strip() for line in f if line.strip()]

with open('burp_payloads.csv', 'w', newline='') as csvfile:
    writer = csv.writer(csvfile)
    for p in payloads:
        writer.writerow([p])

Import burp_payloads.csv into Burp Intruder via Payloads → Load to execute the quick-test sequence.

Command-Line Verification

Execute rapid manual checks using standard shell loops:

while read -r payload; do
    curl -s "http://target.com/login?user=admin&pass=${payload}"
done < SecLists/Fuzzing/Databases/SQLi/Generic-SQLi.txt

This loop transmits each payload as the pass parameter while suppressing response output (-s).

Payload Maintenance and Validation

The repository includes helper utilities in .bin/ to ensure wordlist integrity and consistency.

Validating Wordlists with validators.py

The .bin/validators.py script performs automated quality assurance:

python3 SecLists/.bin/validators.py \
    -i SecLists/Fuzzing/Databases/SQLi/Generic-SQLi.txt \
    -o valid_sql_payloads.txt

According to the source implementation, this utility removes duplicate entries, trims whitespace, and enforces a default 200-byte length limit per payload, ensuring compatibility with restrictive input fields.

Summary

• The Fuzzing/Databases/SQLi/ directory structure organizes payloads by database type and attack methodology.
• Generic-SQLi.txt provides cross-platform coverage while .fuzzdb.txt files offer DBMS-specific exploits for MySQL, MSSQL, and NoSQL targets.
• Plain-text formatting enables immediate integration with ffuf, Burp Suite, sqlmap, and custom automation scripts.
• The .bin/validators.py utility maintains payload quality through deduplication and length validation.
• All collections are distributed under the MIT License within the danielmiessler/SecLists repository.

Frequently Asked Questions

What is the difference between Generic-SQLi.txt and quick-SQLi.txt?

Generic-SQLi.txt contains approximately 300 comprehensive payloads covering union-based, error-based, and boolean-based techniques across multiple database systems. quick-SQLi.txt provides a curated subset of roughly 30 high-probability strings designed for rapid initial reconnaissance when testing time is constrained or when verifying basic vulnerability presence before deep fuzzing.

How do I use SecLists SQL injection payloads with sqlmap?

While sqlmap generates its own injection vectors, you can leverage SecLists to enhance targeted testing. Extract specific strings from MySQL.fuzzdb.txt or MSSQL.fuzzdb.txt and reference them via sqlmap's --string or --regexp options to confirm specific database contexts, or incorporate them into custom tamper scripts placed in sqlmap's tamper/ directory.

Are the SQL injection payloads in SecLists legal to use?

Yes, the repository is released under the MIT License, permitting unrestricted use, modification, and distribution for legitimate security testing. However, these payloads must only be deployed against systems you own or have explicit written authorization to test. Unauthorized use against third-party systems may violate computer fraud and abuse statutes.

Does SecLists include payloads for NoSQL injection testing?

Yes, the repository includes Fuzzing/Databases/SQLi/NoSQL.txt, which contains specialized vectors targeting MongoDB, CouchDB, and other non-relational databases. These payloads exploit NoSQL-specific syntax patterns, such as JavaScript injection in MongoDB queries or alternative operators in JSON-based APIs, distinct from traditional SQL injection techniques.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}