📖 What is SQL Injection (SQLi)?
SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. By inserting malicious SQL code into input fields, attackers can bypass authentication or extract sensitive data from the backend database.
"When seeing a single quote (') in a URL or form field resulting in a database error, immediately suspect SQLi as the primary vulnerability to test."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of SQL Injection (SQLi)?
- ▸ In-band SQLi occurs when the attacker uses the same communication channel to launch the attack and gather results, including error-based and union-based techniques.
- ▸ Inferential or Blind SQLi relies on observing the server's response patterns, such as boolean changes or time delays, to deduce data without direct output.
- ▸ Out-of-band SQLi is used when direct responses are suppressed, forcing the database to send data to an external server via DNS or HTTP requests.
- ▸ Parameterized queries, or prepared statements, are the most effective defense by ensuring the database treats user input as data rather than executable code.
- ▸ Input validation and sanitization act as secondary defenses by filtering or escaping dangerous characters, though they are less robust than parameterized queries.
🎯 How does SQL Injection (SQLi) appear on the PT0-002 Exam?
You may be asked to analyze a HTTP request containing a single quote and a database error in the response, then identify the vulnerability as Error-based SQLi and determine the database type.
A scenario might describe a web page that responds normally to some inputs but delays for several seconds when a SLEEP command is injected, requiring you to identify Blind Time-based SQLi.
Expect questions where you must recommend the most secure remediation for a SQLi vulnerability, requiring you to choose parameterized queries over simple input filtering or blacklisting as the primary fix.
❓ Frequently Asked Questions
What is the difference between Union-based and Error-based SQLi?
Union-based SQLi uses the UNION operator to combine results from a malicious query with the original query's output. Error-based SQLi forces the database to reveal information within the actual error messages returned to the user.
Why is Blind SQLi more time-consuming to exploit than In-band SQLi?
Blind SQLi provides no direct data output. The attacker must ask the database a series of true/false questions and observe the response or timing, extracting data one character at a time.
Can a Web Application Firewall (WAF) fully prevent SQL Injection?
No, WAFs only block known attack patterns. Skilled attackers can often bypass WAFs using encoding or obfuscation. The only definitive solution is updating the application code to use parameterized queries.