📒SQL Injection

What is SQL Injection

SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with requests made by an application to its database. These requests are commonly known as database queries and interfering them generally allow attackers to view data that is normally not accessible. Examples include data belonging to other users, or any other data that the application itself is able to access. In many cases, attackers can modify or delete this data, causing lasting changes to the application's content or behavior. In some situations, an attacker can escalate a SQLi attack to compromise the underlying server or other back-end infrastructure, or performing a denial-of-service attack.

Impact of a successful SQL injection attack

Retrieving hidden data - modify SQL query to retrieve additional results

Subverting application logic - modify SQL query to interfere or change the application's logic

UNION attacks - retrieve data from other database tables

Examing database - extract information about the version and structure of the database

Blind SQL injection - where results of a query are not returned in the application's responses

Retrieving hidden data

Subverting application logic