# SQL Injection Exploitation

> Exploit SQL injection vulnerabilities to extract data, bypass authentication, and escalate privileges through malicious query manipulation in web applications.

- **URL:** https://hackindex.io/services/web/exploitation/sql-injection
- **Path:** HTTP/HTTPS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/web/exploitation.md)
- **Published:** 2026-03-28
- **Updated:** 2026-08-11

SQL injection exploitation uses a confirmed injection point to extract data, dump credentials, read files, and in some configurations execute OS commands. Confirm injection type first through [SQL injection detection](https://hackindex.io/services/web/vulnerability-discovery/sql-injection-detection) before selecting the exploitation technique.

- **Union-based SQLi** extracts data through UNION SELECT when results are reflected in the response.
- **Blind SQLi** infers data one bit at a time using boolean or time-based conditional logic.
- **SQLi to RCE** escalates database access to OS command execution via INTO OUTFILE or xp_cmdshell.

## Choosing an Exploitation Technique

Start from what the injection point gives you:

- **Query results visible in the response**: use union-based extraction. Fastest method, pulls full rows per request.
- **No query output but page differs on true vs false** (content change, status code, redirect): use boolean-based blind. One bit per request, scriptable.
- **No visible difference at all**: use time-based blind. Inject conditional SLEEP or WAITFOR and measure response time. Slowest method.
- **Database error messages with query details**: use error-based extraction. Inject functions like `extractvalue()` (MySQL), `convert()` (MSSQL), or `CAST()` (PostgreSQL) that embed data in error output.
- **Stacked queries supported** (MSSQL via PDO/ODBC, PostgreSQL natively): combine any technique with stacked queries for write operations, enabling xp_cmdshell, COPY TO PROGRAM, or INSERT-based exfiltration.
- **All above fail or are too slow**: try out-of-band (OOB) extraction via DNS lookups or HTTP callbacks when the DB can make outbound connections.

When union-based works, use it. Fall back to boolean, then time-based, then OOB. Error-based sits alongside union as a fast alternative when the application surfaces errors.

## Second-Order SQL Injection

Second-order SQLi stores a malicious payload in the database through one request (registration, profile update, form submission) and triggers it when a different query reads that stored value without sanitization. The injection point and the execution point are separate. A registration form may properly escape the input for the INSERT, but a later admin panel query that reads the stored username concatenates it directly into SQL. Testing requires mapping where user-controlled values are stored and where they resurface in application behavior. A payload like `admin'--` in a username field may not break registration but could bypass authentication when the stored value appears in a login or lookup query elsewhere in the application.

## Pages in This Section

[**Union-Based SQL Injection**](https://hackindex.io/services/web/exploitation/sql-injection/union-based-sqli) covers column count enumeration, data type matching, and extracting database contents through UNION SELECT statements when error output or results are reflected in the response.

[**Blind SQL Injection**](https://hackindex.io/services/web/exploitation/sql-injection/blind-sqli) covers boolean-based and time-based data extraction when the application returns no visible query output, using conditional logic and sleep delays to infer data one bit at a time.

[**Error-Based SQL Injection**](https://hackindex.io/services/web/exploitation/sql-injection/error-based-sqli) extracts data through deliberately malformed expressions that leak query results in database error messages, using functions like extractvalue() and CAST().

[**Stacked Queries SQL Injection**](https://hackindex.io/services/web/exploitation/sql-injection/stacked-queries-sqli) executes entirely new SQL statements (INSERT, UPDATE, xp_cmdshell) by separating them with semicolons, with support varying by database driver.

[**SQLi to Remote Code Execution**](https://hackindex.io/services/web/exploitation/sql-injection/sqli-to-rce) covers escalating database access to OS command execution via MySQL INTO OUTFILE web shell writes, MSSQL xp_cmdshell, and PostgreSQL COPY TO PROGRAM when the database user has sufficient privileges.

[**sqlmap Usage**](https://hackindex.io/services/web/exploitation/sql-injection/sqlmap-usage) automates injection detection and data extraction across all techniques, with support for request files, tamper scripts, and OS shell escalation.

[**Database-Specific SQLi Syntax**](https://hackindex.io/services/web/exploitation/sql-injection/database-specific-sqli-syntax) is a quick reference for adapting payloads across MySQL, MSSQL, PostgreSQL, and Oracle syntax differences.

[**Exfiltrating Database Content via SQLi**](https://hackindex.io/services/web/data-exfiltration/exfiltrating-database-content-via-sqli) covers structured data extraction after confirming injection, from schema enumeration to credential dumping.

## Steps

- [Blind SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection/blind-sqli.md)
- [Database-Specific SQLi Syntax](https://hackindex.io/services/web/exploitation/sql-injection/database-specific-sqli-syntax.md): Covers database-specific SQL injection syntax variations across MySQL, MSSQL, Oracle, and PostgreSQL for crafting targeted exploitation payloads.
- [Error-Based SQLi](https://hackindex.io/services/web/exploitation/sql-injection/error-based-sqli.md): Exploit SQL error messages to extract database information by injecting functions that force verbose errors revealing schema, tables, and data.
- [SQLi to Remote Code Execution](https://hackindex.io/services/web/exploitation/sql-injection/sqli-to-rce.md): Leverage SQL injection vulnerabilities to achieve RCE via techniques like INTO OUTFILE, xp_cmdshell, or UDF injection on web-facing database services.
- [sqlmap Usage Guide](https://hackindex.io/services/web/exploitation/sql-injection/sqlmap-usage.md): Automates SQL injection detection and exploitation against HTTP/HTTPS targets, covering tamper scripts, risk/level tuning, database enumeration, and data extraction techniques.
- [Stacked Queries SQLi](https://hackindex.io/services/web/exploitation/sql-injection/stacked-queries-sqli.md): Leverage stacked query SQLi to execute multiple SQL statements in sequence, enabling data exfiltration, schema enumeration, and command execution via HTTP.
- [Union-Based SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection/union-based-sqli.md)