Web Application Hacking · Topic 7 of 8
SQL Injection Concepts, Types and Methodology
What SQL injection is, why it happens, the in-band, blind and out-of-band types, and the stages an attacker follows from detection to data extraction.
- 5 min
- The cause is user input concatenated into SQL. The cure is parameterized queries.
- In-band: error based and union based. Blind: boolean and time based. Out-of-band uses another channel.
- Blind injection needs many requests but works with no visible output.
What it is
SQL injection (SQLi) happens when an application builds a database query by joining user input into the query text. The database cannot tell the developer's SQL from the attacker's input, so input can change what the query does.
The impact can be reading data that should be hidden, bypassing a login, changing or deleting records, and in some configurations reaching the underlying server. It sits in the Injection category of the OWASP Top 10.
How it works
Concepts
The root cause is mixing code and data. A vulnerable pattern joins a string directly:
query = "SELECT * FROM users WHERE name = '" + name + "'"Whatever the user types becomes part of the SQL. The safe pattern sends the value separately, so it is always treated as data:
cursor.execute("SELECT * FROM users WHERE name = ?", (name,))The second form is a parameterized query (prepared statement). Typical input points are login forms, search boxes, URL parameters, cookies and HTTP headers. A sign that an input may be vulnerable is an unexpected database error message, a changed result, or a different response time after a harmless special character is submitted.
Types of SQL injection
| Type | Description | How the attacker learns the result |
|---|---|---|
| In-band: error based | Forces the database to show information inside an error message | Directly on the page |
| In-band: union based | Uses the SQL UNION operator to add the results of another query to the normal result | Directly on the page |
| Inferential (blind): boolean based | Asks true or false questions and watches whether the page changes | By differences in the page |
| Inferential (blind): time based | Asks the database to wait if a condition is true | By response delay |
| Out-of-band | Makes the database send data over another channel such as a DNS or HTTP request | Through that separate channel |
In-band is the simplest because the same channel is used to attack and to read. Blind injection is slower because data is learned one bit or character at a time, but it works when no error or data is shown. Out-of-band is used when the other methods are unreliable and depends on database features that make network requests.
Other terms the exam uses: a second order injection stores the malicious input first and triggers later when it is used in another query, and a stacked query runs a second statement after the first, which only some database and driver combinations allow.
Methodology
The CEH methodology has three broad stages.
| Stage | Activity |
|---|---|
| Information gathering and vulnerability detection | Find inputs, learn the database type from errors or behavior, test which inputs reach a query |
| Launch the attack | Use the type that suits the application: in-band, blind or out-of-band. Identify the number of columns, the database version, names of tables and columns, then extract data |
| Advanced techniques | Escalate: read files, run operating system commands where the database permits, or move to other systems |
Information gathered along the way includes the database name and version, the current user, table and column names, and then rows of data. Knowing the database type matters because syntax and system tables differ between MySQL, Microsoft SQL Server, Oracle and PostgreSQL.
Impact levels
| Impact | Example |
|---|---|
| Confidentiality | Reading other users' records |
| Integrity | Changing prices or deleting rows |
| Authentication bypass | Logging in without valid credentials |
| Availability | Heavy queries that slow the database |
| Server compromise | Using database features to reach the file system or commands, where the account is over privileged |
A worked example
A product page takes a numeric id in the URL. Adding a single quote to the value returns a raw database error that names the database engine. The page is vulnerable and the error is helpful to an attacker. The fix is a parameterized query, a generic error page and a database account with only the rights the page needs.
How the exam asks about this
- "An attacker learns data by asking true or false questions and watching whether the page changes. Which type?" -> Boolean based blind SQL injection.
- "Which type causes the database to delay its response when a condition is true?" -> Time based blind SQL injection.
- "Which technique combines the output of a second query with the original result?" -> Union based injection.
What to remember for the exam
- The cause is user input concatenated into SQL. The cure is parameterized queries.
- In-band: error based and union based. Blind: boolean and time based. Out-of-band uses another channel.
- Blind injection needs many requests but works with no visible output.
- Second order injection is stored first and triggered later.
- The methodology: detect, attack, then advanced techniques.
Hiding error messages makes error based injection harder, but it does not fix the flaw. Blind techniques still work.
Common mistakes
Calling time based injection in-band. It is blind, because no data is displayed.
Thinking escaping alone is enough. Parameterized queries are the preferred fix.
Forgetting that headers and cookies are inputs. Any value that reaches a query can be an injection point.
Check yourself
What distinguishes in-band from blind SQL injection?
In-band returns data on the same channel the attack uses, while blind infers data from page differences or timing.
What is a second order injection?
Malicious input stored first and executed later when another query uses it.
What is the safest basic code fix?
Use parameterized queries so input is always handled as data.
Topic 7 of 8 in Web Application Hacking
Test yourself on Web Application Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.