Introduction

Before we jump into exciting SQL injection demos and challenges, let’s address some of the most common questions you might have about SQLI!

Classic SQLI

We hope you have the next few days off, because we’re booking a getaway at Hotel Union where you practice SQLIs with the UNION SELECT technique and steal some credentials!

Real world case study: Tutor LMS Plugin UNION-based SQLI

Tutor LMS is a Wordpress plugin for course creation and selling. In versions prior to 1.8.3, the endpoint that returns answers for a given quiz question does not sanitise user input properly nor does it use any parameterised query. This is the perfect condition to practice our UNION-based SQLI attacks in!

In-Band SQLI Playground: Squeal Games

Squeal Games is a gaming platform where you can buy games, view your achievements, unlock new ones, and chat with your friends. It also conceals two SQLI vulnerabilities that you can exploit to your advantage.

Blind SQLI

It’s easy to exploit a SQLI vulnerability when we can see the SQL errors directly returned by the app and all the data returned by our UNION SELECT, but what happens if the developers give generic errors when they detect a UNION SELECT?

Strap in, because here you’ll write your own SQLI exploitation tool!

Real world case study: Blind SQLI in Zenario CMS 8.8

We have now covered all the basics of blind SQLI attacks, let’s unleash our skills and our shiny new tools on a real world case study.

Blind SQLI Playground: Oracle Bank

Instead of exfiltrating data and unlocking passphrases to solve challenges, we are hiring you today to be our consulting detective!

We’re at the end of our ropes trying to catch tax-evading criminals, so we’d like you to look into Oracle Bank using whatever methods you have at your disposal (we’ll turn a blind eye this time).

NoSQLI

What we have in store for you in this section:

• Look at what exactly NoSQL is.
• Get our hands dirty with querying in NoSQL.
• See why NoSQL does not prevent injection attacks.
• Practice simple authentication bypass.
• Practice data extraction with blind NoSQLI and error-based NoSQLI.

Case study: Rocket.Chat 3.12.1

Rocket.Chat is an open source web-app for chats, similar to Discord or Slack. On version 3.12.1, if you know the email address of any user, you can take over their account, escalate to admin privileges, and eventually achieve remote code execution (RCE).

NoSQLI Playground: Aves University

You are an undergraduate student in your final year, ready to graduate. Only... your grades in Advanced Algorithms aren’t as ready as you. You could spend the whole summer resitting those exams, or maybe you could find an easier way to “fix” your grades and graduate on time?

Conclusion

Congratulations 🎉 and a recap of this course!