SQL injection

[chrismory]

SQL Injection is a code injection technique that exploits security vulnerabilities in application-database interactions. It occurs when untrusted data is incorporated into SQL queries without proper validation, sanitization, or parameterization.
Through it, attackers inject and execute unauthorized Structured Query Language (SQL) code, aiming to manipulate, retrieve, modify, or delete data.

Why It Matters: A successful SQL injection can fully compromise a system — leaking usernames/passwords, hijacking sessions, dumping entire databases, and possibly leading to Remote Code Execution (RCE) under certain conditions.

Key Terminology

Injection Types:

• Union-Based: Uses UNION operator to combine results
• Error-Based: Extracts data from error messages
• Boolean-Based Blind: Uses true/false responses
• Time-Based Blind: Uses timing delays to infer data
• Stacked Queries: Executes multiple queries sequentially

Technical Terms:

• Delimiter: Characters like ' or " that break query context
• Comment Operators: --, #, /* */ to ignore remaining query
• Union Operator: Combines SELECT statements
• Information Schema: Database metadata tables
• Payload: Malicious input designed to exploit vulnerability

Key Concepts & Terminologies

Term	Meaning
Vulnerable Parameter	An input vector susceptible to manipulation; e.g., ?id= in URLs.
Backend DBMS	Database Management System: PostgreSQL, MySQL, MSSQL, Oracle, SQLite.
In-Band vs Out-of-Band vs Blind	See below breakdown.
Stacked Queries	Executes multiple SQL statements separated by semicolons (;). Requires explicit support, often disabled by default.
UNION Query	Combines results from two or more SELECT statements, useful when retrieving extra data into visible parts of the page.
Error-Based Injection	Uses database-generated errors to infer schema info (database name, table/column names).
Boolean-Based Blind Injection	Infers truthfulness based on different behaviors (e.g., page shows content vs. not).
Time-Based Blind Injection	Observes delays in response to determine truth (e.g., sleep/pause in DB server).
Out-of-Band Injection	Requires DBMS features like xp_dirtree, LOAD_FILE, etc. Relies on DNS or HTTP callbacks.
Second Order Injection	Payload is injected early in the process but manifests elsewhere later (less common).

Step-by-Step Beginner's Guide

STEP 1: Find a Safe Practice Website
Don't test on real websites! Use these safe practice sites:

1. Go to: https://sqlbolt.com/ (Interactive SQL learning)
2. Or: http://testphp.vulnweb.com/ (Deliberately vulnerable site)
3. Or: https://hackxor.net/ (Web game with vulnerabilities)

Open your browser and go to: http://testphp.vulnweb.com/

STEP 2: Look for Places to Test
On the practice website, look for:

• Search boxes
• Product categories
• Login forms
• URLs that have ?id=1 or ?category=2

Let's try the categories:

1. Click on any category like "Art" or "Music"
2. Look at the URL in address bar - it will look like:

http://testphp.vulnweb.com/listproducts.php?cat=1

STEP 3: Basic Testing in Browser Address Bar

Now try these simple tests in the URL:

Test 1: Add a single quote

Change: http://testphp.vulnweb.com/listproducts.php?cat=1

To: http://testphp.vulnweb.com/listproducts.php?cat=1'

What to look for:

• Does the page show a SQL error?
• Does the page look broken or different?

Test 2: Try basic SQL

http://testphp.vulnweb.com/listproducts.php?cat=1 OR 1=1

Test 3: Try with comments

pictures

STEP 4: Understanding What You're Doing
When you type cat=1' you're essentially breaking the SQL query:

Original SQL query:

SELECT * FROM products WHERE category = '1'

After your input:

SELECT * FROM products WHERE category = '1''

This causes a syntax error because of the extra quote.

STEP 5: Simple Exploitation Examples

Example 1: Show ALL products instead of just category 1

http://testphp.vulnweb.com/listproducts.php?cat=1 OR 1=1

This makes the query:

SELECT * FROM products WHERE category = '1 OR 1=1'

Example 2: Bypass login (if there's a login form)

Username: admin'--

Password: [anything]

This makes the query:

SELECT * FROM users WHERE username = 'admin'--' AND password = 'anything'

The -- comments out the password check!

STEP 6: Let's Practice on Safe Websites

Go to these sites RIGHT NOW and try:

Site 1: Hack This Site

1. Visit:
   

   HackThisSite

   HackThisSite.org is a free, safe and legal training ground for hackers to test and expand their ethical hacking skills with challenges, CTFs, and more.

   www.hackthissite.org
2. Create a free account
3. Go to "Basic Missions"
4. Try the SQL injection challenges

Site 2: SQL Injection Labs

1. Visit:
   

   GitHub - Audi-1/sqli-labs: SQLI labs to test error based, Blind boolean based, Time based.

   SQLI labs to test error based, Blind boolean based, Time based. - Audi-1/sqli-labs

   github.com
2. (This requires setup - more advanced)

STEP 7: Using Browser Developer Tools
Easy way to test forms:

1. Right-click on a login form
2. Click "Inspect" or "Inspect Element"
3. Find the <form> tag
4. You can see where the data gets sent

STEP 8: Simple Step-by-Step Process

For ANY website you're authorized to test:

1. Find input fields (search, login, filters)
2. Test with ' (single quote) - look for errors
3. Test with " (double quote) - look for errors
4. Test with 1 OR 1=1 - see if you get different results
5. Test with 1' AND '1'='1 - see if it works normally
6. Test with 1' AND '1'='2 - see if it breaks

STEP 9: What Success Looks Like

Signs you found SQL injection:

• Error messages mentioning "SQL", "MySQL", "Syntax error"
• Different page content when using SQL commands
• Login bypass with ' OR '1'='1
• More data shown than expected

STEP 10: Immediate Practice

Right now, open a new tab and go to:

login page

Try these in the login form:

Username: test
Password: test' OR '1'='1

Or:

Username: admin'--

Password: [leave empty]

Or:

Username: ' OR 1=1--

Password: [anything]

Important Safety Rules:

1. NEVER test on websites without permission
2. Only use practice websites I listed above
3. Real-world testing without permission is ILLEGAL
4. Use this knowledge to protect your own websites

Next Steps When You're Comfortable:

1. Download SQLmap (automated tool)
2. Learn about Burp Suite (intercepting requests)
3. Study database structure (MySQL, PostgreSQL)
4. Practice on dedicated vulnerable apps like DVWA or WebGoat

Try the steps above on the practice websites first! This will give you hands-on experience without any legal risks.