liveBook · Manning

SQL injection

As explained in Cyber Threat Hunting

An attack technique that injects SQL statements into an application’s data-processing input to manipulate database operations.

SQL injection manipulates application input so that harmful SQL commands enter database queries. It can expose database data, modify contents, or trigger destructive operations when input validation or sanitization is insufficient. section 12.4.1 section 12.4.2

A practical investigation begins with web access logs. Search for SQL keywords and encoded forms of OR, then correlate matching requests with response status, source address, geography, and authentication results. section 12.4.2

Useful investigation signals include:

  • SQL operation terms such as SELECT, FROM, INSERT, and DROP in request data. section 12.4.2
  • OR surrounded by encoded spaces, represented as %20OR%20 or +OR+ in form-encoded requests. section 12.4.2
  • Response status codes that distinguish attempted requests from requests that reached an authorized application path. section 12.4.2
  • Source IP addresses, countries, and Tor exit addresses associated with repeated suspicious requests. section 12.4.2

Interpreting a suspicious request

A request for /patients/1'%20OR%201=1;%20-- contains a Boolean-style injection attempt. If the server returns 401, the request was denied; investigators should still compare all matching events for any successful status. section 12.4.2

Listing 12.2 Sample of common SQL injection commands to look for
# UNION-based SQL injection:
' UNION SELECT null,first_name FROM patients --              #1
 
#Boolean-based SQL injection
' OR 1=1 --                                                  #2
# Error-based SQL injection
‚ OR 1=1; SELECT * FROM patients WHERE 1/0 --                #3
 
# Time-based blind SQL injection:
' OR SLEEP(5) --                                             #4
 
# Command execution SQL injection:
'; DROP TABLE patients; --                                   #5
 
# Out-of-band SQL injection:
' UNION SELECT first_name FROM patients \
INTO OUTFILE '/var/www/html/attacker.php' --                 #6
 
# Stacked queries SQL injection:
'; INSERT INTO users (username, password) \
VALUES ('attacker', 'password'); --                          #7

Browse representative injection patterns, including UNION-based, Boolean-based, error-based, time-based blind, stacked-query, and out-of-band forms. section 12.4.2

Listing 12.3 Searching the Flask web access log for common SQL keywords
@sourcetype=flask:web:access
 /SELECT/i OR /FROM/i OR /INSERT/i OR /DROP/i

Browse a log query that searches Flask web access events for common SQL operation keywords. section 12.4.2

How Cyber Threat Hunting covers it

How deep it goes
Defines injection, names major payload styles, and demonstrates log searches, status analysis, and source investigation without covering remediation.
Examples
Uses encoded patient-endpoint requests, SQL payload variants, Flask log queries, status breakdowns, and geographic source-IP summaries.
What it assumes
Assumes familiarity with HTTP requests, web access logs, status codes, and basic SQL keywords.
What you can do after
Diagnose/debug with it by searching access logs, decoding request patterns, grouping response codes, and profiling suspicious source addresses.
How it connects
Connects SQL injection with input validation, sanitization, authentication, authorization, web access logs, and command injection.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

Compare how 9 books explain SQL injection →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.