SQL Injection Attack
Structured Query Language (SQL) is a database language designed and used for managing records in Rational Database Management Systems (RDBMS). SQL injection is a type of cyber attack that uses malicious SQL code (SQL injection code) to exploit vulnerabilities in any SQL Database to obtain or manipulate to access information that may include valuable numbers of items, lists of customer details, customer’s credit card numbers, sensitive company’s data, or username and password of customers/service users.
Hacker conducts SQL injection attacks by inserting malicious code into a web form field manipulating a website’s code with injection code or searching for SQL vulnerability using SQL Injection tools in the operating system (i.e. Kali Linux) for special exploits. Hackers search for web pages that as login pages, registration pages, search forms, and other webpage forms, within any form code <form> and </form> in between the form is a parameter to discover the vulnerability and later use injection code along with common SQL commands. A hacker might get access to all the user names and passwords in a database, by simply inserting 105 OR 1=1 or blah’ or 1=1– into the input field on a web page to test for SQL vulnerabilities.
Blind SQL Injection
SQL vulnerability test code: http://webpagename/index.php?id=blah’ or 1=1–Β |Β 105 OR 1=1 |Β blah’ or 1=1–Β Β Β or similar SQL commands may allow a hacker to bypass login or flesh rows of a table in a database or even all tables in a database