OSCP · Module 7
SQL Injection Attacks
SQL injection from detection to code execution. UNION, error-based, blind, and stacked query techniques across MySQL, MSSQL, PostgreSQL, and Oracle with sqlmap automation.
~2.5 h 9 resources Last updated September 26, 2026
SQL injection manipulates database queries through unsanitized user input. PEN-200 covers the full spectrum: identifying injection points, extracting data through UNION, error-based, and blind techniques, automating with sqlmap, and escalating from data extraction to operating system command execution. Understanding the differences between MySQL, MSSQL, PostgreSQL, and Oracle syntax is essential since each database has its own exploitation path.
Detection and Manual Exploitation
Finding SQL injection starts with input testing: error messages, boolean differences, and time delays confirm the vulnerability. Manual exploitation through UNION-based, error-based, and blind techniques extracts database contents step by step. Stacked queries open the door to data modification and command execution on supported databases.
Automation and Code Execution
sqlmap automates detection and extraction but understanding manual techniques is required for the exam. The real payoff is escalating from SQL injection to remote code execution: writing web shells through MySQL FILE privilege, enabling xp_cmdshell on MSSQL, or using COPY PROGRAM on PostgreSQL.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
-
Guide 5 min readStacked Queries SQLi
-
Guide 2 min readDatabase-Specific SQLi Syntax
-
Guide 7 min readSQLi to Remote Code Execution
Practice
Apply the module hands-on.
- Game Zone TryHackMe Easy
- Hackme 1 Vulnhub Easy
- Hawat Proving Grounds Easy
- Healthcare 1 Vulnhub Easy
- Help HackTheBox Easy
- Kioptrix: Level 1.1 (#2) Vulnhub Easy
- Kioptrix: Level 1.2 (#3) Vulnhub Easy
- Kioptrix: Level 1.3 (#4) Vulnhub Easy
- NullByte Vulnhub Easy
- Pandora HackTheBox Easy
- Soccer HackTheBox Easy
- Swagshop HackTheBox Easy
- Titanic HackTheBox Easy
- VulnOS 2 Vulnhub Easy
- /dev/random: scream Vulnhub Intermediate
- Breach 3.0.1 Vulnhub Intermediate
- Cockpit Proving Grounds Intermediate
- Pebbles Proving Grounds Intermediate
- pWnOS 2.0 Vulnhub Intermediate
- QuackerJack Proving Grounds Intermediate
- SkyTower 1 Vulnhub Intermediate
- Cache HackTheBox Medium
- Cronos HackTheBox Medium
- DC 9 Vulnhub Medium
- DevGuru 1 Vulnhub Medium
- Jarvis HackTheBox Medium
- Magic HackTheBox Medium
- Mango HackTheBox Medium
- Monitored HackTheBox Medium
- OZ Vulnhub Medium
- Readme 1 Vulnhub Medium
- SecNotes HackTheBox Medium
- Unattended HackTheBox Medium
- Writer HackTheBox Medium
- Breadcrumbs HackTheBox Hard
- Control HackTheBox Hard
- Daily Bugle TryHackMe Hard
- Falafel HackTheBox Hard
- Monitors HackTheBox Hard
- Seventeen HackTheBox Hard