sqli-sql-injection

SQL injection testing in blind scenarios uses boolean-based and time-based inference techniques to infer data character by character. When in-band output is unavailable, out-of-band exfiltration methods like Oracle UTL_HTTP or MSSQL OpenRowSet can verify execution through external network interactions.

DBMS fingerprinting during SQL injection testing identifies the target database engine by analyzing response behaviors, error signatures, and timing characteristics across MySQL, MSSQL, Oracle, PostgreSQL, SQLite, and Cassandra. This determines which payload families and syntax constraints apply for successful exploitation.

WAF evasion for SQL injection uses keyword substitution, whitespace alternatives, comment-based syntax splitting, and encoding tricks to reach executable SQL under filtering. Payload families are adapted to match each DBMS-specific syntax constraints while avoiding known filter patterns.

Second-order SQL injection occurs when user input is stored parameterized but later reused unsafely in a new query construction without sanitization. Testing requires injecting payloads that activate during subsequent query execution at different application sinks rather than immediate reflection points.

SQL injection testing supports DBMS-specific exploitation workflows for MySQL, MSSQL, Oracle, PostgreSQL, SQLite, and Cassandra. Each engine has tailored payload design, pivoting strategies, and escalation paths matching its unique SQL syntax, system tables, and stored procedure capabilities.

Out-of-band exfiltration is used when UNION-based and boolean-blind techniques fail due to suppressed output or restrictive response handling. SQL injection testing routes to OOB channels like Oracle UTL_INADDR or MSSQL OpenRowSet to exfiltrate data through DNS or HTTP callbacks when assessment scope permits.