← Back to Courses/Web Pentest
IntermediateFREE54 hours

What Is SQL Injection?

SQL injection (SQLi) is a class of security vulnerability that occurs when an application includes untrusted data in a SQL query without proper sanitization or parameterization.

Enroll for free to track your progress through this course.

Curriculum (107 lessons)

  1. 1. What Is SQL Injection?
  2. 2. How SQL Injection Executes
  3. 3. Proof of Concept
  4. 4. Types of SQL Injection Vulnerabilities
  5. 5. in-Band SQL Injection
  6. 6. Blind SQL Injection
  7. 7. Second-Order SQL Injection
  8. 8. Impact
  9. 9. Key Takeaways
  10. 10. What Is UNION-Based SQL Injection?
  11. 11. Batched (Stacked) Queries
  12. 12. Time Delays
  13. 13. Conditional Time Delays
  14. 14. DNS Lookup
  15. 15. DNS Lookup with Data Exfiltration
  16. 16. Prevention Reference
  17. 17. Course Structure
  18. 18. Estimated Duration
  19. 19. Determining Column Count
  20. 20. Constructing UNION SELECT Payloads
  21. 21. Extracting Data From Other Tables
  22. 22. Handling Application Output
  23. 23. Limitations
  24. 24. What Is Boolean-Based Blind SQL Injection?
  25. 25. How Boolean Conditions Work
  26. 26. Determining Boolean Conditions
  27. 27. Testing with Character Values
  28. 28. Binary Search Technique
  29. 29. Testing Multiple Characters
  30. 30. Extracting Complete Values
  31. 31. Handling Different Application Responses
  32. 32. Limitations of Boolean-Based Blind Injection
  33. 33. What Is Time-Based Blind SQL Injection?
  34. 34. How Time Delays Work
  35. 35. Database-Specific Delay Syntax
  36. 36. Extracting Data Character by Character
  37. 37. Binary Search Optimization
  38. 38. Information Retrieval with Time Delays
  39. 39. Reducing Extraction Time
  40. 40. What Is Out-of-Band SQL Injection?
  41. 41. How Out-of-Band Injection Works
  42. 42. Microsoft SQL Server
  43. 43. Oracle
  44. 44. PostgreSQL
  45. 45. MySQL
  46. 46. Setting Up the Out-of-Band Server
  47. 47. Bulk Data Exfiltration
  48. 48. What Is Second-Order SQL Injection?
  49. 49. How Second-Order Injection Works
  50. 50. Stage 1: Injection
  51. 51. Stage 2: Exploitation
  52. 52. User Registration and Profile Updates
  53. 53. Search History
  54. 54. Administrative Functions
  55. 55. Why Validation Fails
  56. 56. Detection Methodology
  57. 57. the ORDER BY Technique
  58. 58. How It Works
  59. 59. Interpreting Results
  60. 60. Handling Comments
  61. 61. Limitations of ORDER BY
  62. 62. the GROUP BY Technique
  63. 63. Combining ORDER BY and GROUP BY
  64. 64. SELECT Probing for Column Types
  65. 65. String Injection
  66. 66. Numeric Injection
  67. 67. NULL Injection
  68. 68. Combining Techniques
  69. 69. Practical Example
  70. 70. Identifying the Database Type
  71. 71. Error Messages
  72. 72. Version Queries
  73. 73. Syntax-Based Detection
  74. 74. Accessing Metadata Repositories
  75. 75. MySQL and PostgreSQL
  76. 76. Enumerating Table Contents
  77. 77. Listing Column Names
  78. 78. Extracting Data
  79. 79. Extracting Multiple Rows
  80. 80. Enumerating Database Privileges
  81. 81. File System Access
  82. 82. Systematic Enumeration Workflow
  83. 83. Exploitation Workflow
  84. 84. Phase 1: Reconnaissance
  85. 85. Phase 2: Injection Identification
  86. 86. Phase 3: Database Enumeration
  87. 87. Phase 4: Data Extraction
  88. 88. Phase 5: Post-Exploitation
  89. 89. Scenario: Application Displays Full Query Results
  90. 90. Scenario: Application Displays Only the First Row
  91. 91. Scenario: Application Shows Different Content Based on Conditions
  92. 92. Scenario: No Observable Differences
  93. 93. Input Length Restrictions
  94. 94. Case-Sensitive Filters
  95. 95. Comment Filtering
  96. 96. WAF Evasion
  97. 97. Extracting Large Data Sets
  98. 98. Batch Extraction
  99. 99. Offset-Based Pagination
  100. 100. Conditional Extraction
  101. 101. String Concatenation
  102. 102. Substring Extraction
  103. 103. Comments
  104. 104. Database Version Detection
  105. 105. Database Contents Enumeration
  106. 106. Conditional Errors
  107. 107. Extracting Data via Visible Error Messages

Course price

Free

  • 107 lessons
  • Lifetime access
  • 0 students enrolled
Sign In to Enroll