SQLite - hex value to char or string

Question

I'm writing a tool to exploit SQL Injections. I'm trying to add support to SQLite now and I'm facing a problem: if I need to insert a string but quotes are escaped in Mysql I can use 0x65..., or in Postgres CHR(65)||.... But in SQLite I can't find any way of doing this without using quotes.

Can anyone help me?

Thanks in advance

goodside · Accepted Answer · 2011-10-20 16:13:39Z

2

I don't believe there's a general solution. You may be able to assemble your string using parlor tricks if it contains the right characters. E.g., substr(quote(hex(0)),1,1) will return "'", upper(substr(typeof(cast(0 as text)),3,1)) will return "X", etc. I doubt you can get the whole alphabet this way, but it might be enough for whatever injection you're planning.

answered Oct 20, 2011 at 16:13

goodside

4,6993 gold badges25 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

mynameiscoffey · Accepted Answer · 2011-10-20 15:28:51Z

0

I don't know of an equivalent, however you can check the documentation to see if there is anything you can use:

http://www.sqlite.org/lang_corefunc.html

http://www.sqlite.org/lang_aggfunc.html

answered Oct 20, 2011 at 15:28

mynameiscoffey

16k5 gold badges35 silver badges46 bronze badges

Collectives™ on Stack Overflow

SQLite - hex value to char or string

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related