What is advanced SQL Injection? Infographic
- 1. Web Application Attacks What is SQL Injection? Web Application Hacking & Security Advanced SQL Injection Techniques SQL injection is a technique used to take advantage of un-sanitized input vulnerabilities to pass SQL commands through a web application for execution by a backend database. It is a basic attack used to either gain unauthorized access to a database or retrieve information directly from the database It is a flaw in web applications and not a database or web server issue In advanced SQL injection the attacker does not stop at compromising an application’s data. The attacker will advance the SQL injection attack to compromise the underlying OS and network The attacker may interact with the OS to extract OS details and application passwords, execute commands, access system files, and so on Why Bother About SQL Injection? Based on the use of applications and the way they process user supplied data, SQL injections can be used to implement the following types of attacks: Authentication and Authorization Bypass Information Disclosure Compromised Integrity and Availability of Data Remote Code Execution Database, table, and column enumeration Network reconnaissance using SQL injection 1 Creating database accounts 2 7 Finding and bypassing admin panel of a website 8 Password grabbing PL/SQL exploitation 3 Grabbing SQL server hashes 4 9 Creating server backdoors 10 Interacting with the operating system HTTP header-based SQL injection 5 Interacting with the file system Learn Advanced SQL Injection in Web Application Hacking & Security https://iclass.eccouncil.org/web-application-hacking-and-security/ 6 11 DNS exfiltration 12 REGISTER NOW