Gemini on Question 18, Sep 16

SQL injection (SQLi) vulnerabilities occur when untrusted user input is concatenated directly into a database query without proper sanitization or parameterization. This allows an attacker to manipulate the query's structure, potentially accessing, modifying, or deleting data.

When briefing developers, SQL injection is generally categorized into three main classes based on how the injected data is retrieved or how the vulnerability is observed.

1. In-Band SQLi (Classic SQLi)

In-band SQLi is the most common and straightforward type. It occurs when the attacker uses the same communication channel to both launch the attack and gather results.

There are two primary sub-types of in-band SQLi:

• •Error-Based SQLi: This relies on forcing the database to generate an error message that contains sensitive information about the database structure (like table or column names) or the data itself. The application must be configured to return verbose database errors to the user for this to work.
• •Union-Based SQLi: This technique uses the UNION SQL operator to combine the results of the original query with the results of a newly injected query. If the application displays the results of the original query, it will also display the results of the injected query. This requires the injected query to have the same number of columns and compatible data types as the original query.

2. Inferential SQLi (Blind SQLi)

Inferential SQLi occurs when the application is vulnerable to SQL injection, but its HTTP responses do not contain the results of the relevant SQL query or any database errors. The attacker must infer the structure and data of the database by sending payloads and observing changes in the application's behavior.

There are two primary sub-types of inferential SQLi:

• •Boolean-Based (Content-Based) Blind SQLi: The attacker injects an SQL query that forces the database to evaluate a boolean condition (TRUE or FALSE). Depending on whether the condition is true or false, the application's response changes (e.g., a "User found" message vs. a "User not found" message, or slightly different page content). By asking a series of TRUE/FALSE questions, the attacker can extract data character by character.
• •Time-Based Blind SQLi: This is used when the application does not change its response based on boolean conditions. The attacker injects an SQL query that forces the database to wait a specified amount of time (e.g., using SLEEP() or WAITFOR DELAY) before responding, but only if a certain condition is true. The attacker infers the truth of the condition by measuring how long the server takes to respond.

3. Out-of-Band (OOB) SQLi

Out-of-band SQLi is less common and relies on the database server having the ability to make network connections (e.g., DNS or HTTP requests) to an external server controlled by the attacker.

This technique is typically used when an attacker cannot use in-band or inferential techniques, often because the vulnerable query is executed asynchronously or the application's responses are heavily filtered. The attacker injects a payload that causes the database to transmit the desired data to their external server, rather than returning it in the application's HTTP response.

Related Concept: Second-Order SQLi

While the three classes above describe how data is extracted, it is also important to understand when the injection occurs.

• •First-Order SQLi: The payload is executed immediately when the application processes the user input.
• •Second-Order SQLi (Stored SQLi): The application takes user input and stores it safely in the database (e.g., escaping it properly or using parameterization for the initial INSERT). However, the vulnerability occurs later when that stored data is retrieved and concatenated into a different SQL query without parameterization. Developers often implicitly trust data that comes from their own database, making this a common oversight.