SQL INJECTION
DATABASE EXFILTRATION
MISSION BRIEF
You are a junior web-application security tester assigned to an isolated training environment. The target exposes an employee-search feature. Your objective is to validate whether the search parameter is vulnerable to SQL injection, map the backend database structure, and recover the training flag without modifying application data.
1. INCIDENT STORY
A security assessment team has received a report that the Employee Directory may be leaking database information through its search function. During reconnaissance, the application reveals useful client-side information. The tester then focuses on /search.php, where the q parameter appears to influence database queries. In the supplied lab evidence, automated testing identifies MySQL as the backend and confirms that the parameter can be used for SQL injection. The database list contains information_schema, performance_schema, and a business database named securecorp. Further enumeration reveals tables named secret_flags and users. The final objective is to retrieve the training flag from the secret_flags table and document the evidence.
2. LEARNING OBJECTIVES
Recognize an SQL injection point in a search parameter.
Interpret sqlmap output and distinguish DBMS, database, table, and data enumeration.
Explain why a parameter that reaches a SQL query without safe parameterization can expose backend data.
Trace an attack chain from discovery → database enumeration → table enumeration → data extraction.
Document evidence and propose defensive controls such as prepared statements and least-privilege database accounts.
3. LAB EVIDENCE — DATABASE DISCOVERY
4. BLUE-TEAM CHALLENGE
Assume you are the developer responsible for /search.php. The search value is currently incorporated into a SQL statement using string construction. Rewrite the design at a conceptual level so that attacker-controlled input cannot alter the SQL syntax. Your answer should mention parameterized queries/prepared statements, input handling, and database-account privileges.
5. EVIDENCE & REPORTING CHECKLIST
☐ Record the vulnerable endpoint and parameter.
Get Sourabh Jala’s stories in your inbox
Join Medium for free to get updates from this writer.
☐ Record the identified DBMS.
☐ Record discovered database names.
☐ Record relevant table names.
☐ Capture the final flag as evidence.
☐ Avoid unnecessary modification of application or database data.
☐ Recommend parameterized queries and least-privilege database access.
6. FINAL REFLECTION
In 2–3 sentences, explain why SQL injection is considered a server-side application vulnerability even though the attack begins with user-controlled input in a browser.
FINAL LAB RESULT
Flag{SQLI_EXFILTRATION_SUCCESSFUL}
DELIVERABLES
1. Screenshot of the SQL injection validation / tool evidence.
2. Screenshot showing database or table enumeration.
3. Screenshot clearly showing the recovered training flag.
4. Short finding summary: endpoint, parameter, impact, and remediation.
