=

In-band sql injection

In-band SQL Injection, often referred to as Classic SQL Injection, is the most common type of SQL Injection attack. It occurs when an attacker uses the same communication channel to both launch the attack and gather the results.

This method is straightforward and efficient, making it popular among attackers. There are two main types of in-band SQL Injection -

  1. Error based
  2. Union based

Error based sqli -

This type of SQL Injection is the most useful for easily obtaining information about the database structure, as error messages from the database are printed directly to the browser screen. This can often be used to enumerate a whole database.

Example

Union based sqli -

This technique exploits the UNION SQL operator, which combines the results of multiple SELECT statements into a single HTTP response. Attackers can manipulate the SQL queries to retrieve data from the database that would not normally be accessible through legitimate queries.

Example