SQL Injection Deep Dive
One quote, one query, one breach.
Chapter 05 of the roadmap. Work through each walkthrough below, or browse every topic.
-
SQL Injection: From Dropdown to Database Dump
How a simple order status filter can be exploited to extract every user's credentials from the database.
-
Exploiting a Product Search SQL Injection
How to exploit a vulnerability in a tiny search box to quietly expose an entire database.
-
SQL Injection via X-Forwarded-For Header: Exploiting IP Tracking
The app tracks visitor IPs via the X-Forwarded-For header and drops the raw value into a SQL query. Here's how to exploit it.
-
Second-Order SQL Injection: When Trusted Data Turns Hostile
How a crafted display name stored through a product review becomes a SQL injection payload when an admin filters reviews on the moderation panel.
