# SQL Injection Attacks

> SQL injection from detection to code execution. UNION, error-based, blind, and stacked query techniques across MySQL, MSSQL, PostgreSQL, and Oracle with sqlmap automation.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 2.5
- **Published:** 2026-09-26
- **Updated:** 2026-09-26

SQL injection manipulates database queries through unsanitized user input. PEN-200 covers the full spectrum: identifying injection points, extracting data through UNION, error-based, and blind techniques, automating with sqlmap, and escalating from data extraction to operating system command execution. Understanding the differences between MySQL, MSSQL, PostgreSQL, and Oracle syntax is essential since each database has its own exploitation path.

## Detection and Manual Exploitation

Finding SQL injection starts with input testing: error messages, boolean differences, and time delays confirm the vulnerability. Manual exploitation through UNION-based, error-based, and blind techniques extracts database contents step by step. Stacked queries open the door to data modification and command execution on supported databases.

## Automation and Code Execution

sqlmap automates detection and extraction but understanding manual techniques is required for the exam. The real payoff is escalating from SQL injection to remote code execution: writing web shells through MySQL FILE privilege, enabling xp_cmdshell on MSSQL, or using COPY PROGRAM on PostgreSQL.

## Study material

- [SQL Injection Detection](https://hackindex.io/services/web/vulnerability-discovery/sql-injection-detection.md) (read, core)
- [Union-Based SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection/union-based-sqli.md) (read, core)
- [Error-Based SQLi](https://hackindex.io/services/web/exploitation/sql-injection/error-based-sqli.md) (read, core)
- [Blind SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection/blind-sqli.md) (read, core)
- [Stacked Queries SQLi](https://hackindex.io/services/web/exploitation/sql-injection/stacked-queries-sqli.md) (read, core)
- [Database-Specific SQLi Syntax](https://hackindex.io/services/web/exploitation/sql-injection/database-specific-sqli-syntax.md) (read, core)
- [sqlmap Usage Guide](https://hackindex.io/services/web/exploitation/sql-injection/sqlmap-usage.md) (read, core)
- [SQLi to Remote Code Execution](https://hackindex.io/services/web/exploitation/sql-injection/sqli-to-rce.md) (read, core)
- [MSSQL RCE via xp_cmdshell](https://hackindex.io/services/mssql/exploitation/mssql-rce-via-xp-cmdshell.md) (read, core)