Before exploiting SQL injection, you must first identify where vulnerabilities exist. This lesson covers systematic approaches to discovering SQL injection points in web applications through manual testing and observation.
Building on our understanding of SQL injection fundamentals, we now focus on practical identification techniques that form the foundation of any SQL injection assessment.
SQL injection can occur anywhere user input is processed by the application. The most common injection points include URL parameters, form fields, HTTP headers, and cookies.
The most reliable way to identify SQL injection is through manual testing. This involves sending specially crafted inputs and observing the application's response for signs of vulnerability.
# Basic SQL injection test payloads
' OR '1'='1
' OR 1=1--
" OR "" = ""
' UNION SELECT NULL--
1' AND '1'='1
1; DROP TABLE users--One of the most straightforward detection methods is to trigger database errors. When an application displays database error messages, it often reveals the underlying database type and query structure.
💡 Different databases produce different error messages. MySQL, PostgreSQL, MSSQL, and Oracle each have distinctive error formats that can help identify the database type.
When error messages are suppressed, boolean-based detection can reveal vulnerabilities by comparing responses to true and false conditions.
# True condition - should return normal results
http://target.com/product.php?id=1 AND 1=1
# False condition - should return no results or error
http://target.com/product.php?id=1 AND 1=2⚠️ Always document your testing methodology and obtain proper authorization before testing any application. Keep detailed records of all tests performed.
When neither errors nor boolean differences are visible, time-based detection uses database delay functions to confirm injection. If the application response is delayed, injection is likely possible.
# MySQL time-based test
http://target.com/product.php?id=1 AND SLEEP(5)
# PostgreSQL time-based test
http://target.com/product.php?id=1 AND pg_sleep(5)
# MSSQL time-based test
http://target.com/product.php?id=1; WAITFOR DELAY '0:0:5'Verify exercises to earn ★ 120 XP and unlock next lab level.