SQL Injection
Uploaded by
rohitmukati69SQL Injection
Uploaded by
rohitmukati69What is sql?
SQL stands for Structured Query Language. It is a standard programming language used to
communicate with and manipulate databases.
What Can SQL Do?
SQL allows you to:
● Query data from a database (e.g., SELECT * FROM users)
● Insert new data (e.g., INSERT INTO users VALUES (...))
● Update existing data (e.g., UPDATE users SET password = 'abc')
● Delete data (e.g., DELETE FROM users WHERE id = 5)
● Create and modify tables (e.g., CREATE TABLE users (...))
● Control access using roles, permissions, etc.
Common SQL Databases
● MySQL
● PostgreSQL
● SQLite
● Microsoft SQL Server
● Oracle DB
What is SQL Injection?
SQL Injection is a web security vulnerability that allows an attacker to interfere with the queries
an application makes to its database. It occurs when untrusted input is inserted into an SQL
query without proper sanitization.
How It Works
When user input is concatenated directly into SQL statements, attackers can manipulate the
query by injecting malicious SQL code.
Example – Vulnerable Query:
query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" +
password + "'"
If an attacker enters:
username: ' OR '1'='1#
password: anything
The resulting query becomes:
SELECT * FROM users WHERE username = '' OR '1'='1'# AND password = 'anything'
This always evaluates to TRUE, potentially granting unauthorized access.
Types of SQL Injection
1. Classic (In-Band) SQLi
● Uses the same communication channel to inject and retrieve data.
● Union-based SQLi: Exploits the UNION SQL operator.
● Error-based SQLi: Uses error messages to gather information.
2. Blind SQLi
● No output is returned to the attacker.
● Inference is based on true/false conditions.
○ Boolean-based: Example: ' AND 1=1 --
○ Time-based: Delays response using functions like SLEEP(5) to infer data.
3. Out-of-Band SQLi
● Uses a different channel (like DNS or HTTP requests) to exfiltrate data.
● Works when direct responses are not possible.
4. 2nd Order SQL Injection
● 2nd Order SQL Injection occurs when malicious input is stored in the database during
one action and then used unsafely in a later SQL query, leading to injection. Unlike
classic SQLi, the payload does not execute immediately, but only when the data is later
used in a vulnerable context.
Advanced Attack Scenarios
Extracting database version & users:
UNION SELECT NULL, version(), user()--
Reading files (MySQL):
UNION SELECT LOAD_FILE('/etc/passwd'), NULL--
Writing to files (MySQL with FILE privilege):
INTO OUTFILE '/var/www/html/[Link]'
Impact of SQL Injection
● Unauthorized access to sensitive data (users, passwords, credit cards).
● Bypass authentication, login as admin.
● Delete, modify, or corrupt data.
● Full Remote Code Execution in some cases.
● Data breaches and regulatory penalties (e.g., GDPR, HIPAA).
Prevention & Mitigation
Real-World SQLi Examples
● Heartland Payment Systems (2008) – over 100M card details stolen.
● Yahoo (2012) – 450,000 plaintext credentials leaked via SQLi.
● Tesla (2020) – Hacker reported SQLi in Tesla supplier’s portal.