This document discusses SQL injection and advanced SQL injection techniques. SQL injection allows attackers to pass SQL commands through a web application to exploit vulnerabilities and gain unauthorized access to databases. Advanced SQL injection goes further by compromising the underlying operating system and network. Attackers can use SQL injection to bypass authentication, disclose information, compromise data integrity and availability, execute remote code, enumerate databases and columns, conduct network reconnaissance, and more. The document encourages learning advanced SQL injection to exploit web applications and compromise security.

1. Web Application Attacks
What is SQL Injection?
Web Application
Hacking & Security
Advanced SQL Injection Techniques
SQL injection is a technique used to take advantage of un-sanitized input
vulnerabilities to pass SQL commands through a web application for
execution by a backend database. It is a basic attack used to either gain
unauthorized access to a database or retrieve information directly from the
database
It is a flaw in web applications and not a database or web server issue
In advanced SQL injection the attacker
does not stop at compromising an
application’s data. The attacker will
advance the SQL injection attack to
compromise the underlying OS and
network
The attacker may interact with the OS
to extract OS details and application
passwords, execute commands, access
system files, and so on
Why Bother About SQL Injection?
Based on the use of applications and the way they process user supplied
data, SQL injections can be used to implement the following types of
attacks:
Authentication and
Authorization Bypass
Information
Disclosure
Compromised Integrity and
Availability of Data
Remote Code
Execution
Database, table, and
column enumeration
Network reconnaissance using
SQL injection
1
Creating database accounts
2
7
Finding and bypassing admin
panel of a website
8
Password grabbing PL/SQL exploitation
3
Grabbing SQL server hashes
4
9
Creating server backdoors
10
Interacting with the operating
system
HTTP header-based SQL
injection
5
Interacting with the file system
Learn Advanced SQL Injection in
Web Application Hacking & Security
https://iclass.eccouncil.org/web-application-hacking-and-security/
6
11
DNS exfiltration
12
REGISTER NOW