Introduction

This post covers my progression through PortSwigger’s Web Security Academy SQL injection labs, from Apprentice to Practitioner level. I’ll walk through the core techniques, the reasoning behind each attack, and the key takeaways from each lab category.

UNION-Based Attacks

UNION-based SQL injection lets an attacker combine the results of an injected query with the results of the original query. This requires:

  • Determining the number of columns returned by the original query
  • Identifying which columns are reflected back in the response
  • Extracting data from other tables using those columns
' UNION SELECT NULL,NULL,NULL--

Database Fingerprinting

Before extracting data, it’s important to identify the underlying database (MySQL, PostgreSQL, Oracle, etc.), since syntax and available functions differ significantly across systems. Useful checks include:

  • Version-string queries (SELECT @@version for MySQL, SELECT version() for PostgreSQL)
  • String concatenation syntax differences
  • Comment syntax differences (--, #, /* */)

Blind SQL Injection

When the application doesn’t directly reflect query results, blind techniques come into play:

  • Boolean-based: Inferring data by observing true/false differences in the application’s response
  • Time-based: Using conditional delays (e.g. SLEEP(), WAITFOR DELAY) to infer data when there’s no visible difference in the response at all

Key Takeaways

  • Understanding the underlying SQL syntax matters more than memorizing payloads
  • Blind techniques require patience and often automation (e.g. scripting the extraction)
  • Defense-in-depth (parameterized queries, least-privilege DB accounts) is what actually prevents this class of vulnerability, not just input filtering

What’s Next

Next up: expanding into other injection classes and documenting the same progression for XSS and access control vulnerabilities.