Web Hacking for Pentesters: SQL Injection
SQLi hasn't gone away—it's just hiding behind ORMs and second-order queries. Testers look for places user input influences SQL structure, not every text box with an apostrophe.
This article isn't a payload cookbook; it's how to spot risky query construction and prove impact responsibly.
SQLi hunting starts with curiosity about how search and sort parameters reach the database—ORMs didn't kill the class, they hid it in reporting modules.
Common surfaces
Search filters, sort columns, report builders, legacy admin panels, and JSON fields mapped straight into WHERE clauses. Second-order bugs show up on login or profile update after delayed insert.
Validation mindset
Use error-based clues carefully—don't dump schemas on production without approval. Boolean differences and timing may suffice for proof in staging.
Parameterize queries in remediation advice
Note ORM raw query escape hatches in code review
Map to CWE-89 with clear data access story
Impact framing
Read sensitive rows, auth bypass, or logic manipulation—not abstract 'SQLi exists.'
Heavy extraction tooling belongs in approved environments only.
Stop at the depth agreed in scope—full database dumps aren't default.
If SQLi fixes land during retest, ask what query layer changed—ORM upgrades sometimes move bugs rather than remove them.
Small habits compound—what feels like overhead early becomes speed when deadlines hit.
ORM false comfort
Raw queries hide in reporting modules and search—grep code for string concatenation when white-box.
Second-order bugs need patience—note insert points and later query sinks separately in reports.
Safe demonstration
Prefer boolean or timing proofs agreed in ROE over schema dumps—clients remember restraint.
ORM layers with raw query escape hatches need grep during code review passes.
Recommend parameterized queries and least-privilege DB accounts paired—not alone.
Worth reading next
Penetration Testing: Web Application Checklist (WAPT)
Information Disclosure: The Quiet Vulnerability Class
End of Manual Secure Code Review ...
Comments