SQL Injection (SQLi) Types By ITSec

 

SQL Injection (SQLi) Types By ITSec

SQL Injection (SQLi) is a code injection technique that exploits vulnerabilities in applications that interact with databases. There are several types of SQL injection attacks, each with its own methods and impacts. Here are the main types:

In-band SQLi (Classic SQLi): This is the most common and easiest to exploit. It occurs when an attacker uses the same communication channel to both launch the attack and gather results. There are two primary techniques:

Error-based SQLi: Relies on error messages thrown by the database server to gain information about the database structure.

Union-based SQLi: Uses the UNION SQL operator to combine the results of two or more SELECT statements into a single result2.

Inferential SQLi (Blind SQLi): This type of attack does not transfer data via the web application and the attacker cannot see the result of the attack in-band. Instead, the attacker sends payloads and observes the web application’s response and the resulting behavior of the database server. There are two types:

Boolean-based (content-based) Blind SQLi: Sends an SQL query to the database which forces the application to return a different result depending on whether the query returns a TRUE or FALSE result.

Time-based Blind SQLi: Sends an SQL query to the database which forces the database to wait for a specified amount of time before responding2.

Out-of-band SQLi: This type of attack is used when the attacker cannot use the same channel to launch the attack and gather results, or when the server responses are not stable. It relies on the database server’s ability to make DNS or HTTP requests to deliver data to an attacker2.

These are the primary types of SQL injection attacks. Each type has its own methods and impacts, and understanding them is crucial for protecting applications from such vulnerabilities.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

ITSec Security Consulting Limited

ITSec Security Consulting Limited

IT Security Assessment And Audit, SRAA, Penetration Test (Pen Test),Compliance, Data Security,ISO 27001 Audit, GDPR Audit, PCI DSS, Cyber Security, Risk assessment, Data Protection, Data Privacy, SOX, CISA, CEH,CISSP, CISM

Secure Your Computers from Cyber Threats and mitigate risks with professional services to defend Hackers.

Contact Us:

Find Us immediately for the Security Assessment in Hong Kong(HK), United Kingdom(UK), Europe(EU), Estonia(EE), Singapore(SG), Canada(CA):

Website:

www.itsec.hk

www.itseceu.uk

www.sraa.com.hk

www.penetrationtest.hk

www.itsec.vip

Facebook:

https://www.facebook.com/ITSec-Security-Co...

Google:

https://itsecsecurityconsulting.business.s...

Contact Us:  

https://itsec.vip/contact/

Company's Cooperation: 

www.itteacheritfreelance.hk

留言

張貼留言

這個網誌中的熱門文章

Types of XSS Attacks By ITSec Security Consulting Limited

圖片
Introduction to XSS Attacks Cross-Site Scripting (XSS) is a prevalent web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts, often written in JavaScript, can steal sensitive information, manipulate website content, or impersonate users. XSS attacks exploit the trust users place in a website, leading to severe consequences for both users and web applications. Types of XSS Attacks Stored XSS (Persistent XSS)  Stored XSS occurs when malicious scripts are permanently stored on the target server, such as in a database, comment field, or forum post. When a user accesses the affected page, the script is executed in their browser. For example, an attacker might inject a script into a user profile page, which then executes whenever another user views that profile. Example CVE: CVE-2020–10385: A stored XSS vulnerability in the WPForms Contact Form plugin for WordPress. Reflected XSS  Reflected XSS happens when ma...
閱讀完整內容

Understanding Out-of-Band SQL Injection: A Comprehensive Guide By ITSec Security Consulting Limited

圖片
Introduction to SQL Injection SQL Injection (SQLi) is a prevalent attack vector that exploits vulnerabilities in web applications by manipulating SQL queries. It allows attackers to interfere with the queries an application makes to its database, potentially leading to unauthorized access to sensitive data. What is Out-of-Band SQL Injection? Out-of-Band SQL Injection (OOB SQLi) is a type of SQL injection where the attacker does not receive a response from the attacked application on the same communication channel. Instead, the application sends data to a remote endpoint controlled by the attacker. This method is particularly useful when the attacker cannot use the same channel to launch the attack and gather results. How Out-of-Band SQL Injection Works Out-of-Band SQLi relies on the ability of the database server to make DNS or HTTP requests to a remote server. The attacker injects a payload that triggers these requests, allowing them to exfiltrate data without direct interaction with ...
閱讀完整內容

Boolean-based (Content-based) Blind SQL Injection

圖片
  Introduction SQL Injection (SQLi) is a code injection technique that exploits vulnerabilities in an application's software. It allows attackers to interfere with the queries that an application makes to its database. Blind SQL Injection occurs when an attacker can infer information from the database without seeing the actual data. Boolean-based Blind SQLi relies on true/false conditions to extract information. Understanding SQL Injection SQL Injection allows attackers to execute arbitrary SQL code on a database. There are several types of SQL Injection: Classic SQL Injection : Directly retrieves data from the database. Blind SQL Injection : Infers data indirectly when the application does not display error messages or data directly. Time-based Blind SQL Injection : Uses time delays to infer information. Error-based SQL Injection : Relies on error messages to extract data. Blind SQL Injection Blind SQL Injection is used when the application does not display error messages or data ...
閱讀完整內容