SQL Injection Introduction 🚀

TryHackMe Walkthrough

SQL Injection (SQLi) is one of the most dangerous web vulnerabilities and remains a common issue in modern web applications. In this room, I explored how SQL Injection works, different exploitation techniques, and the defensive measures used to prevent it.

Task 2 — SQL Essentials for Injection

This task introduced important SQL concepts that form the foundation of SQL Injection attacks, including comments, UNION queries, wildcards, LIMIT, string functions, and the information_schema database.

Question: What SQL statement combines results from two SELECT queries into one result set?

Answer: UNION

Question: What built-in database contains metadata about all other databases, tables, and columns in MySQL?

Answer: information_schema

Task 3 — What is SQL Injection?

This section explained how SQL Injection vulnerabilities occur when user input is directly incorporated into database queries without proper sanitization.

Question: What character is commonly used as a first test when probing for SQL Injection?

Answer: '

Question: What type of SQL Injection returns results directly in the web page?

Answer: In-Band

Task 4 — In-Band SQL Injection

I learned about Error-Based and Union-Based SQL Injection techniques and how attackers can leverage them to enumerate databases and extract sensitive information.

Question: What subtype of In-Band SQLi relies on database error messages to extract information?

Answer: Error-Based

Question: What SQL function returns the name of the current database in MySQL?

Answer: database()

Task 5 — Blind SQL Injection: Authentication Bypass

This task demonstrated how SQL Injection can be used to bypass authentication by manipulating login queries.

Question: What boolean condition is commonly injected to make a WHERE clause always evaluate to true?

Answer: 1=1

Task 6 — Blind SQL Injection: Boolean and Time-Based

This section covered techniques used when query results are not directly visible and attackers must rely on application behavior.

Question: What MySQL function causes a deliberate time delay in a query’s response?

Answer: SLEEP

Task 7 — Out-of-Band SQL Injection

I explored scenarios where data must be exfiltrated through external communication channels when traditional SQL Injection methods are unavailable.

Get Sushen Kumar’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Question: What protocol beginning with D is commonly used to exfiltrate data in Out-of-Band SQLi?

Answer: DNS

Question: What MSSQL stored procedure can be used to trigger DNS lookups for data exfiltration?

Answer: xp_dirtree

Task 8 — Remediation and Prevention

The room concluded by discussing secure coding practices and mitigation techniques against SQL Injection.

Question: What is the primary and most effective defence against SQL Injection?

Answer: Prepared Statements

Task 9 — Practical SQL Injection

The practical lab provided hands-on experience with multiple SQL Injection scenarios and exploitation techniques.

Level 1 Flag

THM{SQL_INJECTION_3840}

Level 2 Flag

THM{SQL_INJECTION_9581}

Level 3 Flag

THM{SQL_INJECTION_1093}

Level 4 Flag

THM{SQL_INJECTION_MASTER}

Key Takeaways

• Understanding SQL query structure is essential for identifying SQL Injection vulnerabilities.
• In-Band SQL Injection provides direct feedback through application responses.
• Blind SQL Injection relies on behavioral differences and timing attacks.
• Out-of-Band SQL Injection can be used when no direct feedback channel exists.
• Prepared Statements remain the strongest defense against SQL Injection.

✅

🔗 Connect with me and follow my hacking journey

🛠 Explore my code and projects on [GitHub](https://github.com/alivexd)

✍️ Read my detailed write-ups and tutorials on [Medium](https://medium.com/@alivexd)

🔐 Track my progress and challenges on [TryHackMe](https://tryhackme.com/p/alivexd)

💼 Let’s network professionally on [LinkedIn](https://linkedin.com/in/sushen-kumar)