PostSwigger SQL Injection Lab Walkthrough

Introduction

SQL Injection (SQLI) is a critical vulnerability that allows attackers to manipulate database queries. In this blog, we will explore an SQL injection attack on a product filtering system where the WHERE clause is vulnerable.

Understanding the Vulnerability

Consider the following SQL query used by the application when filtering products by category:

SELECT * FROM products WHERE category = 'Gifts' AND released =1;

Here, the application fetches products from the “Gifts” category that have been released (released =1). However, if user input is not properly sanitized, an attacker can manipulate the query.

Exploiting the Vulnerability

To retrieve hidden (unreleased) products, an attacker can inject a condition that always evaluates to TRUE.

‘ OR 1=1 --

When inserted into the query, it becomes:

SELECT * FROM products WHERE category = ‘ ‘ OR 1=1 -- ‘ AND released ;

. ‘ OR 1=1 -- teminates the existing condition and forces the query to return all products, including unreleased ones.

. -- is a common in SQL, which ignores the remaining part of the query.

Steps to Perform the Attack

1. Identify an input field where SQL injection is possible.

2. Inject the payload (‘ OR 1=1 --) into the category field.

3. Submit the request and observe if unreleased products appear.

Before applying payload it shows only 3 categories.

Replace the accessories with SQL payload:

After replacing, it showing the hidden categories.

Mitigation Strategies

To prevent SQL injection:

1. Use prepared statements and parameterized queries.

2. Implement input validation and allowlist filtering.

3. Use least privilege principles for database access.

Conclusion

SQL Injection remains a major security threat. By understanding hoe these vulnerabilities work and implementing best practices, developers can secure their applications effectively.