# SQL Injection

> Exploit SQL injection via UNION, error-based, blind, and stacked queries; automate with sqlmap; escalate to file read and RCE; plus NoSQL injection.

- **URL:** https://hackindex.io/learn/oswa-web-200-study-path/sql-injection
- **Certification:** [OSWA (WEB-200) Study Path](https://hackindex.io/learn/oswa-web-200-study-path.md)
- **Estimated study hours:** 3
- **Published:** 2026-09-26
- **Updated:** 2026-09-26

With an injectable parameter confirmed, exploitation extracts data, escalates to code execution, and ultimately reaches the admin session and proof the OSWA exam requires. The technique you choose depends on how the application responds: UNION when results are reflected, error-based when the database leaks errors, and blind (boolean or time-based) when there is no visible output at all. Beyond data theft, stacked queries and database-specific features turn SQL injection into remote command execution.

## Manual Exploitation Techniques

UNION-based injection appends attacker-controlled rows to the result set to dump metadata, tables, and credentials. Error-based extraction abuses functions that leak data inside error messages. Blind injection extracts data one bit at a time through boolean or time-based inference. Stacked queries run entirely separate statements, enabling data modification and, on some engines, command execution. Second-order injection fires when stored input is later used unsafely in a different query.

## Automation, Exfiltration, and RCE

sqlmap (permitted on the OSWA exam) automates detection, extraction, file operations, and OS shells, especially when driven from a saved Burp request with tamper scripts. Beyond dumping credentials and hashes, SQL injection can read files (LOAD_FILE, pg_read_file, OPENROWSET) and escalate to RCE: MySQL FILE web shells, MSSQL xp_cmdshell, and PostgreSQL COPY TO PROGRAM.

## NoSQL Injection

Applications backed by MongoDB and similar stores are vulnerable to NoSQL injection: operator injection for authentication bypass, boolean and time-based extraction, and $where JavaScript injection. JSON APIs are a common entry point, with their own WAF bypass and encoding considerations.

## Study material

- [SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection.md) (read, core)
- [Union-Based SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection/union-based-sqli.md) (read, core)
- [Error-Based SQLi](https://hackindex.io/services/web/exploitation/sql-injection/error-based-sqli.md) (read, core)
- [Blind SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection/blind-sqli.md) (read, core)
- [Stacked Queries SQLi](https://hackindex.io/services/web/exploitation/sql-injection/stacked-queries-sqli.md) (read, core)
- [sqlmap Usage Guide](https://hackindex.io/services/web/exploitation/sql-injection/sqlmap-usage.md) (read, core)
- [Exfiltrating Database Content via SQLi](https://hackindex.io/services/web/data-exfiltration/exfiltrating-database-content-via-sqli.md) (read, core)
- [SQLi to Remote Code Execution](https://hackindex.io/services/web/exploitation/sql-injection/sqli-to-rce.md) (read, core)
- [NoSQL Injection](https://hackindex.io/services/web/exploitation/nosql-injection.md) (read, core)