OSWA: SQL Injection (SQLi)

SQL injection tests whether input alters query structure. The exam expects reliable detection, DBMS fingerprinting, and data extraction without destroying application state.

Core rules and concepts

• Contexts include string literals, numeric fields, LIKE clauses, ORDER BY, LIMIT, and INSERT/UPDATE values. Each needs different syntax.
• Techniques: error-based, UNION, boolean blind, time blind, stacked queries where supported, and out-of-band.
• MySQL comments require a space after -- (-- -), or use # and /**/. Metadata lives in information_schema; GROUP_CONCAT merges rows; SLEEP(5) tests timing.
• MSSQL uses WAITFOR DELAY '0:0:5', sys.objects, and xp_cmdshell when privileged.
• PostgreSQL uses pg_sleep(5), || concatenation, and CAST. Oracle requires FROM dual and uses DBMS_PIPE.RECEIVE_MESSAGE.
• UNION requires matching column count and compatible types.

Worked example

id=1' returns HTTP 500, while id=1' -- - returns normally, confirming a string context. Increment ORDER BY 1 through ORDER BY 5; column 5 errors, so there are four columns. Send id=-1' UNION SELECT 1,2,3,4 -- -; positions 2 and 3 render on the page. Extract the database with id=-1' UNION SELECT 1,database(),3,4 -- -. Reasoning: the negative id suppresses the original row so only the injected row displays, and the reflected positions tell you where string data can be placed.

Traps that cost marks

• Using -- without a trailing space in MySQL.
• Mismatching column counts or data types in UNION payloads.
• Breaking requests by failing to URL-encode &, #, or spaces.
• Assuming stacked queries are enabled.
• Missing second-order injection where stored input is concatenated later.
• Trusting a single timing result under variable server load.