SQL injection is a critical security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Master data exfiltration, authentication subversion, UNION attacks, blind conditional errors, and out-of-band exfiltration across four distinct skill tiers.
This lab contains a SQL injection vulnerability in the product category filter. Exploit the query to bypass the release filter and retrieve unreleased catalog items.
This lab contains a SQL injection vulnerability in the login mechanism. Craft an injection payload that circumvents credential evaluation to log in as the administrator user.
This lab contains a SQL injection vulnerability in the product category filter. Perform a UNION attack against the Oracle database to retrieve and display the database version banner.
This lab contains a SQL injection vulnerability in the product category filter. Perform a UNION attack to retrieve the database version string from MySQL and Microsoft SQL servers.
Determine the number of columns returned by the original query using ORDER BY or UNION SELECT NULL probes to prepare for structured data exfiltration.
Probe individual columns within a multi-column result set using string literals to identify columns compatible with text-based data extraction.
Execute a UNION attack against the product query to extract usernames and passwords from the database users table, then log in as the administrator.
Concatenate multiple database fields into a single column using database-specific string concatenation operators to retrieve credentials through a single text column.
Query the information_schema metadata tables on PostgreSQL/MySQL to enumerate table names and column definitions, then extract administrator credentials.
Query Oracle system views all_tables and all_tab_columns while satisfying Oracle syntax requirements (FROM dual) to locate and dump user credentials.
Trigger descriptive database type-conversion errors that leak sensitive query results directly into application HTTP error responses.
Exploit a blind injection vulnerability in a session cookie where Boolean responses alter UI content to extract the administrator password character by character.
Construct queries that conditionally trigger internal database errors (divide-by-zero or Oracle TO_CHAR faults) to infer confidential password characters.
Identify and verify blind injection vulnerabilities by invoking synchronous sleep/delay functions (e.g., pg_sleep) that pause server responses for 10 seconds.
Exfiltrate confidential password characters by executing conditional sleep statements that only delay response execution when guesses evaluate to true.
Exploit asynchronous background database queries by forcing the database server to perform out-of-band DNS/HTTP requests to an external listener system.
Exfiltrate sensitive database records asynchronously by concatenating password values into subdomains queried during out-of-band DNS resolutions.
Bypass Web Application Firewall (WAF) signature inspection by encoding SQL keywords into XML numeric entities decoded by back-end parsers prior to query execution.