CyberXplained
Back to Attack Techniques

SQL Injection Attacks

Explore the mechanics, types, and defenses against SQL Injection attacks in cybersecurity.

What is a SQL Injection Attack?

SQL Injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an application's entry fields for execution.

Types of SQL Injection Attacks

  • In-band SQLi: Attacker uses the same communication channel to launch the attack and gather results.
  • Inferential SQLi (Blind): No data is transferred via the web application and the attacker reconstructs the database structure by sending payloads.
  • Out-of-band SQLi: Attacker retrieves database data using a different channel (e.g., making a DNS or HTTP request to a server controlled by the attacker).
  • Union-based SQLi: Leverages the UNION SQL operator to combine the results of two or more SELECT statements into a single result.
  • Error-based SQLi: Forces the database to generate an error, giving the attacker information upon which to refine their injection.

Preventing SQL Injection Attacks

  • Use parameterized queries or prepared statements
  • Implement input validation and sanitization
  • Employ the principle of least privilege for database accounts
  • Use stored procedures with parameterized queries
  • Implement Web Application Firewalls (WAF)
  • Regularly update and patch database systems
  • Encrypt sensitive data in the database
  • Implement proper error handling to avoid information leakage
  • Use Object-Relational Mapping (ORM) libraries
  • Conduct regular security audits and penetration testing

DDoS Attack Simulation

Experience a simulated DDoS attack in Visualization

User
Server
Database
Database Secure

SQL Injection Examples

Common SQL Injection techniques and their explanations (for educational purposes only)

Basic Authentication Bypass

This injection comments out the password check, potentially allowing unauthorized access.

SELECT * FROM users WHERE username = 'admin' --' AND password = 'password'

UNION-based Data Extraction

This injection attempts to extract user credentials by appending them to a legitimate query.

SELECT name, description FROM products WHERE id = 1 UNION SELECT username, password FROM users --

Blind SQL Injection

This type of injection is used when the results are not directly visible to the attacker.

SELECT * FROM users WHERE id = 1 AND (SELECT CASE WHEN (username = 'admin') THEN 1 ELSE 0 END) = 1

Time-based Blind SQL Injection

This injection uses time delays to infer information about the database.

SELECT * FROM users WHERE id = 1 AND IF(SUBSTRING(username,1,1) = 'a', SLEEP(5), 0)

Stacked Queries

This injection attempts to execute multiple SQL statements, potentially destroying data.

SELECT * FROM products WHERE id = 1; DROP TABLE users; --