Lesson 2 of 15

SQL Injection

SQL injection remains one of the most dangerous and prevalent web vulnerabilities, allowing attackers to manipulate database queries to extract, modify, or delete data. You will learn how SQL injection works at a fundamental level, the different types (error-based, blind, time-based), and how to exploit them manually and with automated tools. Understanding SQL injection deeply is essential for both attacking and defending web applications.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "how SQL injection works at a fundamental level" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

Web applications are the most common attack surface in modern security. The OWASP Top 10 vulnerabilities alone account for the majority of real-world breaches. Mastering web application security opens the door to bug bounty programs, penetration testing contracts, and application security roles.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

SQL Injection · Objective 1 of 4

VIDEO

Loading video…

Test for SQL injection

In DVWA, navigate to the SQL Injection module and enter a single quote (') in the User ID field, then click Submit. If the application returns a database error message such as 'You have an error in your SQL syntax', the input is being passed directly to the database without sanitization — a clear SQL injection vulnerability. The error message itself is also a finding: verbose database errors reveal the database type, version, and query structure to an attacker. Document the exact input, the URL, and the full error message as evidence.

Bypass login with SQL injection

Navigate to the DVWA login page and enter ' OR '1'='1 as the username with any password. This payload closes the username string in the SQL query and appends a condition that is always true, causing the WHERE clause to match every row in the users table and returning the first user — typically an admin account. If the login succeeds, you have demonstrated authentication bypass via SQL injection, one of the most critical vulnerability classes. Try variations such as admin'-- to comment out the password check entirely.

Extract data with UNION injection

In the DVWA SQL Injection module, first determine the number of columns in the original query by injecting '1 ORDER BY 1--', '1 ORDER BY 2--', and so on until you get an error — the last successful number is the column count. Then inject '1 UNION SELECT user, password FROM users--' to retrieve usernames and password hashes from the users table. The UNION operator appends your query's results to the original query's results, allowing you to read any table in the database. This technique can extract the entire database schema and all stored data.

Automate with SQLmap

Copy the URL of the DVWA SQL Injection page including the id parameter (e.g. http://target/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit) and run 'sqlmap -u "<url>" --cookie="PHPSESSID=<your-session>; security=low" --dbs' to automatically detect and exploit the SQL injection. SQLmap will identify the injection point, determine the database type, and enumerate all available databases. Use '--tables -D dvwa' to list tables and '--dump -T users -D dvwa' to extract all data from the users table. SQLmap automates what you did manually in the previous steps, but understanding the manual technique is essential for cases where automated tools fail.

Previous: OWASP Top 10 Overview Next Lesson