SQL Injection Exploitation

SQL injection exploitation uses a confirmed injection point to extract data, dump credentials, read files, and in some configurations execute OS commands. Confirm injection type first through SQL injection detection before selecting the exploitation technique.

• Union-based SQLi extracts data through UNION SELECT when results are reflected in the response.
• Blind SQLi infers data one bit at a time using boolean or time-based conditional logic.
• SQLi to RCE escalates database access to OS command execution via INTO OUTFILE or xp_cmdshell.

Choosing an Exploitation Technique

Start from what the injection point gives you:

• Query results visible in the response: use union-based extraction. Fastest method, pulls full rows per request.
• No query output but page differs on true vs false (content change, status code, redirect): use boolean-based blind. One bit per request, scriptable.
• No visible difference at all: use time-based blind. Inject conditional SLEEP or WAITFOR and measure response time. Slowest method.
• Database error messages with query details: use error-based extraction. Inject functions like extractvalue() (MySQL), convert() (MSSQL), or CAST() (PostgreSQL) that embed data in error output.
• Stacked queries supported (MSSQL via PDO/ODBC, PostgreSQL natively): combine any technique with stacked queries for write operations, enabling xp_cmdshell, COPY TO PROGRAM, or INSERT-based exfiltration.
• All above fail or are too slow: try out-of-band (OOB) extraction via DNS lookups or HTTP callbacks when the DB can make outbound connections.

When union-based works, use it. Fall back to boolean, then time-based, then OOB. Error-based sits alongside union as a fast alternative when the application surfaces errors.

Second-Order SQL Injection

Second-order SQLi stores a malicious payload in the database through one request (registration, profile update, form submission) and triggers it when a different query reads that stored value without sanitization. The injection point and the execution point are separate. A registration form may properly escape the input for the INSERT, but a later admin panel query that reads the stored username concatenates it directly into SQL. Testing requires mapping where user-controlled values are stored and where they resurface in application behavior. A payload like admin'-- in a username field may not break registration but could bypass authentication when the stored value appears in a login or lookup query elsewhere in the application.

Pages in This Section

Union-Based SQL Injection covers column count enumeration, data type matching, and extracting database contents through UNION SELECT statements when error output or results are reflected in the response.

Blind SQL Injection covers boolean-based and time-based data extraction when the application returns no visible query output, using conditional logic and sleep delays to infer data one bit at a time.

Error-Based SQL Injection extracts data through deliberately malformed expressions that leak query results in database error messages, using functions like extractvalue() and CAST().

Stacked Queries SQL Injection executes entirely new SQL statements (INSERT, UPDATE, xp_cmdshell) by separating them with semicolons, with support varying by database driver.

SQLi to Remote Code Execution covers escalating database access to OS command execution via MySQL INTO OUTFILE web shell writes, MSSQL xp_cmdshell, and PostgreSQL COPY TO PROGRAM when the database user has sufficient privileges.

sqlmap Usage automates injection detection and data extraction across all techniques, with support for request files, tamper scripts, and OS shell escalation.

Database-Specific SQLi Syntax is a quick reference for adapting payloads across MySQL, MSSQL, PostgreSQL, and Oracle syntax differences.

Exfiltrating Database Content via SQLi covers structured data extraction after confirming injection, from schema enumeration to credential dumping.