sql injection
sql injection
User input concatenated into SQL queries lets attackers exfiltrate, modify, or destroy data. Still in the OWASP Top 10 for a reason.
SQL injection is the textbook input-validation failure: an application stitches user-controlled strings into a query without separating data from code, and the database happily executes whatever the attacker writes.
The labs in this category cover the full progression: classic in-band exploitation, error-based extraction, blind boolean and time-based, second-order, and out-of-band variants. Each lab ships with a deliberately vulnerable target you can spin up locally, a walkthrough of the exploit, and notes on the corresponding remediation.
// labs
0 live · 3 totalblind time-based sql injection
hardExtract data one bit at a time when the application reveals nothing in its response. We use SLEEP() as a side-channel and write a small Python harness to automate the extraction.
error-based sql injection
easyWhen the application leaks database errors, we can use functions like EXTRACTVALUE() and UPDATEXML() to extract data inside error messages.
second-order sql injection
impossibleThe injection lands in one request and detonates in a later one. Hard to spot in code review, devastating in practice.