SQL injection
Boolean and error first. Blind time second. OAST last. Never dump a customer table.
Tags: sqli, inject, oast
Checklist
- Find the query: Search, sort, id, filter JSON, GraphQL args, report exports, old SOAP. One parameter at a time.
- Syntax probe: A quote or a comment that changes status or error shape vs a control. Unique marker in the error is evidence, not a dump.
- Boolean: AND 1=1 vs AND 1=2 on an owned row. Page content, length, or redirect must differ.
- Column / UNION: Only against an owned dataset. Match column count with NULLs, then a unique canary string you search for.
- Blind OAST: If there is no error and no boolean, a DNS/HTTP callback from a stacked or function probe beats sleep() on production.
- Second-order: Value stored now, queried in a report/job later. Watch the job, not the insert response.
- Stop: No information_schema crawls of other tenants, no xp_cmdshell, no file writes. Primitive plus one owned-row proof.