In-band SQL injection
In-band SQL Injection
In-band SQL Injection is the most common and generally the easiest type of SQL injection attack to exploit. It belongs to one of the three main classifications of SQL injection attacks (the others being Blind/Inferential and Out-of-Band SQL Injection).
The characteristic feature of an In-band SQL Injection attack is that the attacker utilizes the same communication channel to both perform the attack and retrieve the results.
The output of both the intended and the new query may be printed directly on the front end, and we can directly read it.
In-Band SQL Injection is the easiest type to detect and exploit; In-Band just refers to the same method of communication being used to exploit the vulnerability and also receive the results, for example, discovering an SQL Injection vulnerability on a website page and then being able to extract data from the database to the same page.
Types of In-band SQL Injection Attacks
The most commonly used and easy-to-exploit types of in-band SQL injection attacks are:
Error-based SQL Injection
The attacker intentionally inserts bad inputs into an application, which forces the database to return database-level error messages.
The attacker then reads these resulting errors (which may contain sensitive data or information about the database structure) to find a vulnerability and subsequently construct a malicious query. This approach is often useful for building a vulnerability-exploiting request.
UNION SQL Injection
The attacker uses a UNION clause to append a malicious query (the "forged query") to the original query requested by the user.
The result of the forged query is appended to the result of the original query, enabling the attacker to obtain the values of fields from other tables.
For this technique to work, the individual queries must return the same number of columns and the data types in each column must be compatible.
The attacker often determines the number of columns using the ORDER BY clause until an error is encountered.
Other In-band Techniques
Other types of injection techniques that fall under the general category of In-band SQL Injection include those based on manipulating the structure or syntax of the query itself:
Tautology
An attacker uses a conditional OR clause such that the condition of the WHERE clause will always be true (e.g., OR '1'='1'). This is commonly used to bypass user authentication.
End-of-Line Comment
The attacker uses line comments (often denoted by --) in the input, causing the database to execute the attacker's malicious code and then ignore the rest of the original query line (which often contains legitimate logic like password checks).
Piggybacked Query
An attacker injects an additional malicious query into the original query using a semicolon (;) as a query delimiter. This allows the database management system (DBMS) to execute multiple stacked SQL queries, enabling the attacker to extract, add, modify, delete data, execute remote commands, or perform a DoS attack.
Illegal/Logically Incorrect Query
An attacker intentionally sends an incorrect query to the database to generate an error message that may be useful for further attacks, such as extracting the structure of the underlying database.
System Stored Procedure
Malicious inputs are used to execute malicious SQL statements within a database's stored procedure, particularly if the procedure uses dynamic SQL that does not sanitize user inputs.