Concept - SQLi Categories
| Category | Description (s.16) | Example (s.16) |
|---|---|---|
| In-band | same channel for attack and data retrieval | SQLi showing data on a web page |
| Inferential | deduces data from behaviour or timing; no direct data shown | Blind SQL injection |
| Out-of-band | one channel to attack, another to get data | SQLi using DNS/HTTP to send results externally |
- In-band types (s.17): tautology (conditions always true, s.13), end-of-line comment (
--nullifies the legitimate code after the injection, s.15), piggybacked queries (extra queries added on a legitimate request, s.15). - Inferential (s.18): no actual transfer of data; the attacker reconstructs information by sending requests and observing behaviour. Technique: illegal/logically incorrect queries reveal the type and structure of the backend database; works because default error pages are often descriptive.
- Out-of-band (s.19): results arrive by another channel, e.g. an email with the query results sent to the tester; used when retrieval is limited but outbound connectivity from the database is lax.
Related: Concept - SQL Injection, Concept - SQLi Countermeasures, Concept - Inference (different idea, similar name). Appears in 05 Database Security - Chunk 01 (s.1-38).