Archive of SQL Injection Techniques
-
SQL Injection Inference Attacks
Posted in SQL Injection TechniquesUnderstanding the fundamentals inference attacks. Inference technique is the pillar of blind SQL injection and it is used in many advanced attacks. It allows testing for vulnerabilities and even extract information when no data is returned to the end user. Moreover, mastering its fundamentals will...
Continue reading this entry → -
Using Comments to Simplify SQL Injection
Posted in SQL Injection TechniquesTerminating query with comments to achieve SQL injection. Terminating the query properly is one of the main difficulties an attacker may encounter while testing. Frequently, the problem comes from what follows the integrated user parameter. This SQL segment is part of the query and the malicious input must...
Continue reading this entry → -
SQL Injection Using UNION
Posted in SQL Injection TechniquesUnderstanding how to create a valid UNION-based attack to extract information. UNION-based attacks allow the tester to easily extract information from the database. Because the UNION operator can only be used if both queries have the exact same structure, the attacker must craft a SELECT statement...
Continue reading this entry → -
SQL Injection Login Bypass
Posted in SQL Injection TechniquesUnderstanding SQL injection attacks against login form. Login bypass is without a doubt one of the most popular SQL injection techniques. This article presents different ways an attacker can use to defeat a login form. Principles detailed here are simple but strongly related to Continue reading this entry →
-
Stacked Queries
Posted in SQL Injection TechniquesExecute multiple statements in the same query to extend the possibilities of SQL injections. Stacked queries provide a lot of control to the attacker. By terminating the original query and adding a new one, it will be possible to modify data and call stored procedures. This technique is massively used in SQL injection attacks...
Continue reading this entry →
