SQLi labs
SQL Injection (SQLi)
What is SQLi?
SQL Injection (SQLi) happens when user-controlled input is concatenated into a SQL query without parameterization. It lets you read, modify or exfiltrate the entire database, and on some engines even run operating system commands.
Why practice SQLi?
Even though modern ORMs protect against SQLi, dynamic queries in search, filter and reporting endpoints are still a frequent vector. A critical SQLi typically pays between $1,000 and $20,000 because it exposes PII, credentials and, in many cases, RCE via xp_cmdshell or INTO OUTFILE.
What will you learn with the SQLi labs?
You'll learn to detect injection with polyglot payloads, fingerprint the engine (MySQL/Postgres/MSSQL/Oracle/SQLite), pick the right technique (UNION, boolean blind, time blind, OOB), automate with sqlmap using real configs, and prove impact by extracting schemas, hashes and tokens.
Types of SQLi we cover
- Union-based
You combine your SELECT with the original to pull data straight into the response. Requires control over the number of columns.
- Boolean-based blind
No visible output: you infer bit by bit comparing TRUE/FALSE responses. Works when there's a minimal difference in the page.
- Time-based blind
When there isn't even a visible difference: you inject SLEEP/WAITFOR and measure latency. Slow but universal.
- Error-based
You leverage verbose error messages (extractvalue, updatexml) to extract data inside the message itself.
- Out-of-Band (OOB)
You force the server to make a DNS/HTTP request to your Burp Collaborator. Useful when output and errors are suppressed.
How do you find and exploit SQLi?
A practical playbook — from recon to proof of concept.
- 1
Detect the injection
Drop a single quote into each parameter and watch for SQL errors, 500s or behavior changes. Then confirm with a condition that doesn't break the query.
id=1' → error; id=1' AND '1'='1 → 200; id=1' AND '1'='2 → different - 2
Fingerprint the engine
Each DBMS has its own functions. Use concatenation and version to tell whether it's MySQL, PostgreSQL, MSSQL or Oracle, and pick the right syntax.
MySQL: ' AND 1=version()-- - · Postgres: ' AND 1=cast(version() as int)-- - - 3
Count columns for UNION
Before a UNION SELECT you need to know how many columns the original query returns. Incremental ORDER BY until it fails.
' ORDER BY 1-- - ... ' ORDER BY 6-- - → error at 6 → there are 5 columns - 4
Extract data with UNION
Place your data in the columns that reflect on the page. Start with the schema and finish on credentials/tokens.
' UNION SELECT username,password,3,4,5 FROM users-- - - 5
If it's blind, go blind
With no output and no errors, infer character by character via boolean response or latency with SLEEP/WAITFOR.
1' AND (SELECT SUBSTRING(password,1,1) FROM users LIMIT 1)='a'-- - · 1' AND SLEEP(5)-- - - 6
Automate and escalate
Once confirmed manually, let sqlmap do the heavy dumping and, if the engine allows it, try file read or RCE.
sqlmap -u "https://target/item?id=1" --batch --dbs --threads=5
Learn the theory
Academy: SQL & NoSQL Injection
Loading labs...
View in full catalog →Frequently asked questions
What is a SQL Injection?
It's a vulnerability where user input is inserted into a SQL query without parameterization, letting you alter the query logic to read, modify or exfiltrate the database.
How is a SQLi exploited?
You inject SQL syntax into a vulnerable parameter. With UNION SELECT you extract data directly; with boolean or time-based blind you infer it character by character; and on some engines you escalate to file read (INTO OUTFILE) or command execution (xp_cmdshell).
How do you find SQLi in bug bounty?
Try a quote in every parameter (including headers, cookies and JSON) and look for errors or changes. Search endpoints, filters, dynamic ORDER BY sorting and reporting are the most exposed because they tend to concatenate raw SQL.
How do you prevent SQL Injection?
Use parameterized queries (prepared statements) or a well-configured ORM, validate and type the input, apply least privilege on the DB account, and never build SQL by string concatenation.
Difference between SQLi and NoSQL Injection?
SQLi attacks relational databases (MySQL, Postgres) by manipulating SQL syntax. NoSQL Injection attacks databases like MongoDB by abusing operators ($ne, $gt, $where) smuggled via JSON or query string; the syntax and engine change, but the root cause (unsanitized input in the query) is the same.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice SQLi in real labs
Every SQLi lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime