SQL injection is a code injection technique that allows attackers to execute malicious SQL statements to gain unauthorized access to data. It works by inserting SQL code into user input fields for execution by the backend database. This can give attackers full access to the database, including reading local files, uploading files, and accessing administrator privileges. While errors may reveal vulnerabilities, "blind SQL injection" occurs when no errors are displayed, requiring time-based or boolean techniques to exploit. Prevention methods like filtering and blacklisting can be bypassed, so the most secure approach is using parameterized statements to separate data from code.

1. SQL INjection
-Gautham MK
A SQL query walks into a bar and sees two tables. He walks up to
them and says 'Can I join you?’ -r/ProgrammerHumour

2. Some important concepts
before we jump right in
Data
Database
SQL

3. What is SQLi?
SQL injection is a code
injection technique, used to attack
data-driven applications, in which
nefarious SQL statements are inserted
into an entry field for execution.

4. How dangerous is
SQLi?

6. Give full access to the database-you
basically have everything you need.
Read local files outside the www root.
Upload and read files similar to file
inclusion vulnerabilities and even php
shells.
Access admin privileges by logging in as the
admin.

7. Carrying out a simple SQLi
attack by inserting into text
fields
Try to break the page by using and,
order by or ” ’ ”
Test text boxes and urls of the
form: https:///www.target.com/
page.php?something=something
Can be used for bypassing logins

8. Extracting sensitive
data
Use order by to identify the number of columns
and find out where the information is displayed.
Perform a union select to output multiple values
and find the database information
Find the table names in a particular database.
(use information_schema)
Find the required table and try to extract useful
information.

9. Discovering SQLi and
extracting data using
sqlmap
Automates detection of SQLi
vulnerabilities
sqlmap -u target url

10. Looking at a more
challenging type of SQLi
attacks: Blind SQLi
We don’t have a clue as to whether
the web application is vulnerable to
injection attack or not. i.e no error
messages are displayed.
Can be exploited using time based
and boolean based methods.

11. Looking at a more
challenging type of SQLi
attacks: Blind SQLi
We don’t have a clue as to whether the
web application is vulnerable to
injection attack or not. i.e no error
messages are displayed.

12. Preventing SQLi
Using filters to make it look like there are
no exploits. Can be bypassed.
Using black lists to prevent the occurrence
of order by, union, etc. Can be bypassed.
Using a white list to allow only specific
commands. Can be bypassed.
Use parameterised statements, separate data
from code

15. Thank You