What is SQL Injection?
SQL Injection is a malicious attack where malicious users can inject SQL commands (commonly referred to as malicious payload) in SQL statement that controls the web application database (commonly referred to as Relational Database Management System – RDBMS), within the web input field.The SQL injection vulnerability can damage any website or web application that is currently using SQL-based database. This is one of the most dangerous web attack where the malicious users tend to exploit the web applications.

The malicious users can get unauthorized access to the web application, by making use of the SQL injection to bypass the authentication and authorization mechanism defined by any web application. This vulnerability in web applications give illegal access to the malicious user to modify, update or delete the database or make changes to any particular row and columns, in result the data integrity of SQL-based database should be affected.

How SQL Injection Works?
To exploit a web application, malicious users must have to find an input field that lies in the SQL query of the database.

In order for an SQL injection attack to take place, the vulnerable website needs direct user input in the SQL query that is injected in the SQL statement. In this way the malicious users inject a payload that is included in SQL query and hence it should be used to attack against the database server.

Before the actual attack, first check how the server responds to user’s input for authentication mechanism.

// define POST variables
$Uname = $_POST[‘name’];
$Upassword = $_POST[‘password’];

// sql query vulnerable to SQLi
$sql = “SELECT id from users where username = ‘Uname’ && password = ‘Upassword’ “;

// execute the sql query by database
database.execute($sql);

This was an example of how the user’s authentication credentials are checked or verified by the database server.

As shown the above code is vulnerable to SQL injection, the malicious user can gain access to the web application by submitting the malicious payload in the SQL query that would alter the SQL statement being executed by the database server.

A simple example of an SQL injection payload could be something as simple as setting the password field to

password’ OR ‘1’=’1′

where this condition is always true.

This would result in the following SQL query being run against the database server.

SELECT id FROM users WHERE username=’username’ AND password=’password’ OR 1=1’

What’s the worst an attacker can do with SQL?
SQL (Structured Query Language) is a programming language used to work with the databases, commonly Relational Database Management Systems are brought into work.

SQL language can be used to update, modify or delete the databases or the tables, columns, rows within RDBMS databases.

It is a powerful language to attack databases itself. Attackers can use this language to exploit databases of the web applications and take control of the application without the Administrator’s consent.

Keeping the above in mind, when considering the following, it’s easier to understand how lucrative a successful SQL injection attack can be for an attacker.

• An attacker can use SQL injection to bypass authentication or even impersonate specific users.
• SQL is used to delete records from a database. So an attacker could use an SQL injection vulnerability to delete data from a database. Even if an appropriate backup strategy is employed, deletion of data could affect an application’s availability until the database is restored.
• One of SQL’s primary functions is to select data based on a query and output the result of that query. An SQL injection vulnerability could allow the complete disclosure of data residing on a database server.
• Since web applications use SQL to alter data within a database, an attacker could use SQL injection to alter data stored in a database. Altering data affects data integrity and could cause repudiation issues, for instance, issues such as voiding transactions, altering balances and other records.
• Some database servers are configured (intentional or otherwise) to allow arbitrary execution of operating system commands on the database server. Given the right conditions, an attacker could use SQL injection as the initial vector in an attack of an internal network that sits behind a firewall.

Practical Attack On Website With SQL Injection:
It will be easier to understand the exploitation of website using SQL injection, if you already have some idea about what all the SQL injection is. So let’s move on and search for a real hacking environment.

We will move on step by step to keep the simplicity in achieving our goals.

Step 1
Search for Google Dorks.

Following are some of the dorks, I just gathered. There are quite number of dorks you can search on your own.

inurl:”.php?cmd=”
inurl:”.php?z=”
inurl:”.php?q=”
inurl:”.php?search=”
inurl:”.php?query=”
inurl:”.php?searchstring=”
inurl:”.php?keyword=”
inurl:”.php?file=”
inurl:”.php?years=”
inurl:”.php?txt=”
inurl:”.php?tag=”
inurl:”.php?max=”
inurl:”.php?from=”
inurl:”.php?author=”
inurl:”.php?pass=”
inurl:”.php?feedback=”
inurl:”.php?mail=”
inurl:”.php?cat=”
inurl: