SQL Injection in PEN-200

    SQL Injection (SQLi) is a prevalent and critical vulnerability in web applications, and it is a significant focus in the PEN-200 course. 

Understanding SQL Injection

    SQL Injection occurs when an attacker can insert or manipulate SQL queries through input fields in a web application. This vulnerability arises from insufficient input validation, allowing attackers to execute arbitrary SQL code against the database. The implications can range from unauthorized data access to complete control over the database server.

Types of SQL Injection Techniques

1. Classic SQL Injection:
   • This involves directly injecting malicious SQL code into input fields. For example, consider a login form where the backend query is:

     sql
     SELECT * FROM users WHERE username='$username' AND password='$password';
     

   • An attacker might input:

     text
     $username = 'admin' OR '1'='1';
     $password = 'any_password';
     

   • The resulting query would be:

     sql
     SELECT * FROM users WHERE username='admin' OR '1'='1' AND password='any_password';
     

   • This query will always return true, allowing unauthorized access.
2. Union-Based SQL Injection:
   • This technique allows attackers to combine results from multiple SELECT statements. For instance, if an application executes:

     sql
     SELECT name FROM products WHERE id=$id;
     

   • An attacker could manipulate the input to:

     text
     $id = 1 UNION SELECT username, password FROM users;
     

   • The resulting query would attempt to fetch usernames and passwords from the users table, provided that the number of columns matches.
3. Error-Based SQL Injection:
   • This method exploits error messages returned by the database to extract information. By intentionally causing errors in queries, attackers can glean insights about the database structure.
   • For example, using an invalid column name might generate an error message revealing existing columns.
4. Blind SQL Injection:
   • In scenarios where error messages are suppressed, attackers can still infer information based on the application's response time or behavior.
   • For instance, using time delays with conditional statements like:

     sql
     IF (SELECT COUNT(*) FROM users) > 0 WAITFOR DELAY '00:00:05';
     

   • If the application takes longer to respond, it indicates that the condition was true.

Practical Example of Exploiting SQL Injection

Let’s illustrate a practical scenario where an attacker targets a vulnerable web application:

Scenario: Accessing User Data

1. Identifying Vulnerability:
   • An attacker discovers that the application has a search feature that directly interacts with the database without proper sanitization.
2. Crafting Malicious Input:
   • The attacker inputs:

     text
     ' OR '1'='1'; --
     

   • This input modifies the underlying SQL query into something like:

     sql
     SELECT * FROM users WHERE username='' OR '1'='1'; --';
     

3. Retrieving Data:
   • If successful, this query could return all user records since OR '1'='1' is always true.
4. Using UNION to Extract Additional Data:
   • Suppose the attacker wants to retrieve sensitive information from another table. They might try:

     sql
     ' UNION SELECT username, password FROM users; --
     

   • The application must return results with a matching number of columns for this to work effectively.
5. Finalizing Exploitation:
   • After confirming successful injection and data retrieval, the attacker may leverage this access for further exploitation, such as privilege escalation or data exfiltration.

Conclusion

Understanding and exploiting SQL injection vulnerabilities is crucial for penetration testers participating in the PEN-200 course. Mastery of various injection techniques—classic, union-based, error-based, and blind—enables testers to effectively assess and demonstrate vulnerabilities in web applications. Proper documentation of these processes is essential for compliance with exam requirements and for providing clear evidence of exploitation during assessments.