SQL injection hunting

Tags: sqli, inject, oast, export

Level: intermediate

Method

1. Find the query surface

   Search, sort, id, filters, JSON bodies, GraphQL args, CSV exports, old SOAP. One parameter, one hypothesis.

   Tools: Burp Suite, arjun

2. Control vs syntax probe

   Send a unique marker, then a single quote or comment. Status, error text, length, or redirect must change vs the control. The error is evidence of parsing, not a license to dump.

   Tools: sqlmap, ghauri

3. Boolean on an owned row

   AND 1=1 vs AND 1=2 against a record you created. Content, length, or Location must differ. That is the primitive.

   Tools: Burp Suite

4. Blind without sleep

   If there is no error and no boolean, prefer a DNS/HTTP canary over SLEEP() on production. One unique callback per field.

   Tools: interactsh-client, sqlmap

5. Second-order and exports

   Value stored now, queried in a report, search index, or async job later. Watch the job, not the insert response.

   Tools: Burp Suite

Field notes

• sqlmap --batch against a live program is how you get banned. Use it as a lab oracle, or with tight -p and --risk=1 on an owned row.
• UNION into other tenants is out. UNION a canary you search for in an owned export is in.

References

• https://portswigger.net/web-security/sql-injection
• https://owasp.org/www-community/attacks/SQL_Injection