Exploiting Web Applications with SQL Injection: A Step-by-Step Guide

3 min readJun 1, 2024

SQL Injection remains one of the most critical and widespread vulnerabilities in web applications, often leading to severe data breaches and security compromises. Understanding how to exploit this vulnerability is essential for penetration testers and security professionals.

What is SQL Injection?

SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. By manipulating input fields, attackers can execute arbitrary SQL commands, potentially accessing or modifying sensitive data.

Types of SQL Injection

In-Band SQLi

Error-Based SQLi: This technique relies on error messages from the database server to extract information. Attackers inject SQL code that causes the database to return error messages, which can reveal details about the database structure.

Union-Based SQLi: This method uses the UNION SQL operator to combine the results of two or more SELECT statements into a single result. Attackers can use this to retrieve data from different database tables.

Inferential SQLi (Blind SQLi)

Boolean-Based Blind SQLi: Attackers inject SQL code that forces the application to return different responses based on the truth value of a SQL statement. This allows them to infer information about the database.

Time-Based Blind SQLi: This technique involves injecting SQL code that causes the database to delay its response. By measuring the time taken for responses, attackers can infer information.

Out-of-Band SQLi

Out-of-Band SQLi relies on the database server’s ability to make HTTP or DNS requests to retrieve data. This method is less common but can be used when in-band techniques are not effective.

Setting Up a Test Environment

Tools Needed

DVWA (Damn Vulnerable Web Application): A deliberately vulnerable web application for testing purposes.

SQLMap: An automated tool for SQL injection and database takeover.

Burp Suite: A web vulnerability scanner with a robust proxy for intercepting HTTP requests.

Setting Up DVWA

Download and Install DVWA: You can download DVWA from GitHub. Follow the installation instructions to set it up on your local machine or use a pre-configured virtual machine like Metasploitable.
Configure DVWA: Ensure you have set the security level to low for easier testing and learning.

Basic Workflow for Exploiting SQL Injection

Identifying SQL Injection Vulnerabilities

Manual Testing: Begin by manually testing input fields. For instance, enter a single quote (') into a search field. If the application returns a SQL error, it indicates a potential SQL injection vulnerability.

Using Burp Suite: Intercept HTTP requests with Burp Suite. Modify the parameters to include SQL injection payloads and observe the responses for signs of SQL injection.

Exploiting SQL Injection

Error-Based SQLi:

' OR '1'='1' --

Injecting this payload into a vulnerable field can cause the database to return error messages, revealing information about the database structure.

Union-Based SQLi:

' UNION SELECT null, table_name FROM information_schema.tables --

Use this payload to retrieve table names from the database.

Boolean-Based Blind SQLi:

' AND 1=1 --
' AND 1=2 --

Observe the difference in application responses to infer information about the database.

Time-Based Blind SQLi:

' AND IF(1=1, SLEEP(5), 0) --

Injecting this payload will cause a delay in the response, indicating a vulnerability.

Automating SQL Injection Attacks with SQLMap

Basic SQLMap Usage:

sqlmap -u "http://target.com/vulnerable.php?id=1"

This command will scan the URL for SQL injection vulnerabilities.

Advanced SQLMap Options:

sqlmap -u "http://target.com/vulnerable.php?id=1" --dump-all

Use this command to dump all the data from the database.

Mitigating SQL Injection Vulnerabilities

Prepared Statements and Parameterized Queries: Use these to ensure that user inputs are treated as data, not executable code.
Input Validation and Sanitization: Implement strict input validation to ensure that only expected data is accepted.
Web Application Firewalls (WAFs): Deploy WAFs to detect and block SQL injection attempts.

Conclusion

SQL Injection is a powerful technique for exploiting web application vulnerabilities. By understanding and practicing the techniques discussed, you can effectively identify and mitigate these vulnerabilities. Set up your test environment and try out the SQL injection techniques to enhance your penetration testing skills.

Stay tuned for our next post, where we’ll explore cross-site scripting (XSS) attacks and how to prevent them. Happy hacking!