← Back to Academy

Academy Node

SQL Injection Checks

SQLi checks test whether user-controlled input reaches backend SQL queries unsafely.

Beginner100 XPWeb

Why it matters

SQLi can expose creds, files, hashes, or command execution depending on DBMS.

How to identify it

  • Error-based behavior
  • Boolean differences
  • Time delays

Linux commands

sqlmap -u 'http://TARGET/item.php?id=1' --batch --risk 2 --level 3
sqlmap -r request.txt --batch --risk 2 --level 3
curl 'http://TARGET/item.php?id=1\''

Expected output

  • SQL error
  • Boolean-based injectable
  • DBMS fingerprint

Success looks like

  • Dumped creds or file read/write
  • Auth bypass
  • RCE path

Failure looks like

  • No behavioral difference

Troubleshooting

  • Use Burp request file
  • Include session cookie
  • Test manually first

Common mistakes

  • Not saving request with cookies
  • Not testing POST bodies
  • Not checking stacked queries where relevant

Alternative attacks

  • Default creds
  • File upload
  • LFI

What to try next

  • Dump users
  • Crack hashes
  • Try password reuse against SMB/WinRM/MSSQL

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.