• The point wherein a web application using SQL can turn into SQL Injection is when user-provided data gets included in the SQL query.
  • The semicolon in the URL signifies the end of the SQL statement, and the two dashes cause everything afterwards to be treated as a comment. By doing this, you’re just, in fact, running the query:
SELECT * from blog where id=2;--

In-Band

  • Refers to the same method of communication being used to ==exploit the vulnerability and also receive the results.==
  • For example, discovering an SQL Injection vulnerability on a website page and then being able to extract data from the database to the same page.

Error-Based

  • This type of SQL Injection is the most useful for easily obtaining information about the database structure as error messages from the database are printed directly to the browser screen.

Union-Based

  • This type of Injection utilises the ==SQL UNION operator alongside a SELECT statement to return additional results to the page.==
  • Query will gather a list of tables that are in this database.
0 UNION SELECT 1,2,group_concat(table_name) FROM information_schema.tables WHERE table_schema = 'sqli_one'/

Blind

Authentication Bypass

  • It is when we get little to no feedback to confirm whether our injected queries were, in fact, successful or not, this is because the error messages have been disabled, but the injection still works regardless.

Boolean Based

  • Refers to the response we receive back from our injection attempts which could be a true/false, yes/no, on/off, 1/0 or any response which can only ever have two outcomes.
  • That outcome confirms to us that our SQL Injection payload was either successful or not.

Time Based

  • Is very similar to the above Boolean based, in that the same requests are sent, but there is no visual indicator of your queries being wrong or right this time. Instead, your indicator of a correct query is based on the time the query takes to complete.
  • This time delay is introduced by using built-in methods such as SLEEP(x) alongside the UNION statement. ==The SLEEP() method will only ever get executed upon a successful UNION SELECT statement.==

Out of Band

  • Classified by having two different communication channels, one to launch the attack and the other to gather the results.
  • For example, the attack channel could be a web request, ==and the data gathering channel could be monitoring HTTP/DNS requests made to a service you control.==

Prevention

  • Prepared Statements (With Parameterized Queries)
    • Writing prepared statements ensures that the SQL code structure doesn’t change and the database can distinguish between the query and the data.
  • Input Validation
    • Employing an allow list can restrict input to only certain strings, or a string replacement method in the programming language can filter the characters you wish to allow or disallow.
  • Escaping User Input
    • Escaping user input is the method of prepending a backslash (****) to these characters, which then causes them to be parsed just as a regular string and not a special character.