Sec-Art: SQL Injection

Showing posts with label SQL Injection. Show all posts

Web for pentester VM SQL-Injection Examples Walk-through | SQL-Injection Solutions

Web for Pentester is a pre-configured Virtual Machine ISO prepared for practicing Web Pentesting by PentesterLab. Now in this article we going to look at the SQL Injection vulnerabilities. And in order to setup the Virtual Machine, please visit the link :

Link : Install and configure Web for Pentester VM

In web for pentester VM there are 9 exercise for SQL Injection vulnerability. Which are as follows :

Sqlmap Tutorial for Beginners : How to use sqlmap | Exploiting SQL Injection vulnerability with sqlmap

Sqlmap is a powerful sql injection automation tool, used to exploit sql injection vulnerabilities on websites and web applications. It is written in python language. With sqlmap we can exploit remote databases and extract information from them. For examples like database names, table names, column names, all the data in the tables etc. can be extracted from the database. It can also read and write files on the remote file system under certain conditions.

Time-based SQL Injection | Types of SQL Injection

As we know that if web application does not return any visible error when the SQL query fails, then we use Boolean based SQL injection. In boolean based SQL injection we simply ask questions from the database in the form of “true or false” statements and according to the response of web application, we can enumerate the database. But lets assume that in the web application there is no distinction between the results of true and false statements and there are absolutely no errors returned from the database. Now in this situation the boolean based injection did not work. So in this this situation we have to perform time-based SQL injection.

Boolean-based SQL Injection | Types of SQL Injection

Sometimes there is no visible error message on the page when an SQL query fails, making it difficult for an attacker to get information from the vulnerable application. However there is still a way to extract information.

In a Boolean-based SQL injection attack, we simply ask questions from the database in the form of “true or false” statements. A true statement returns a different result than a false statement, so based upon this, we are able to enumerate and extract information present in the database. A true statement means that the information that we are asking for is present inside the database; a false statement would mean it is not present. To generate a true or false statement, we can use the AND/OR statement and inspect the response that the website returns.

Some basic concept to start with SQL injection

In this post we are going to look some basic concepts regarding to SQL injection techniques and methodologies.

Basic SQL Functions

SELECT	read data from the database based on searching criteria
INSERT	insert new data into the database
UPDATE	update existing data based on given criteria
DELETE	delete existing data based on given criteria
UNION	used to combine the result-set of two or more SELECT statements.
WHERE	used to extract only those records that fulfill a specified condition.
Order By	used to sort the result-set in ascending or descending order.
Limit By	statement is used to retrieve records from one or more tables.

Blind SQL Injection | Types of SQL Injection

Blind SQL (Structured Query Language) injection is a type of SQL Injection where the attacker asks the database true or false questions and determines the answer based on the applications response. This attack is often used when in the case or error, the web application is configured to show generic page specified by the developer instead of useful error messages.

Error-based SQL Injection | Types of SQL Injection

Error based SQL injection is a technique of exploiting database servers, that relies on error messages thrown by the database server to obtain information about the structure of the database. In some cases, error-based SQL injection alone is enough for an attacker to enumerate an entire database. While errors are very useful during the development phase of a web application.

Union-based SQL Injection | Types of SQL Injection

Union-based SQLi is an in-band SQL injection technique that leverages the UNION SQL operator to combine the results of two or more SELECT statements into a single result which is then returned as part of the HTTP response.

The Union-based SQLi is most common type of SQL injection. It comes from the class of inband SQL injection, and this type of attack utilizes the use of a UNION statement, which is the combination of two select statements, to extract information from the database.

SQL Injection Basics | introduction to SQL Injection

SQL injection or SQLi is a web application security weakness that allows attackers to control an application’s database by tempering with the database query. An SQL injection flaw simply allows an attacker to inject or tamper with certain parts of a database query in a web application to perform attacker-specified operations such as exfiltration of data, writing files to the database server, or even achieving server side code execution.