cyber-security-resources/web_application_testing/sqli_evasion.md

SQL Injection (SQLi) Evasion Techniques

1. Obfuscation Techniques

1.1 Comment Insertion

• Definition: Use SQL comments to break up or hide parts of the SQL query.
• Example: 1' OR 1=1-- can be obfuscated as 1' OR 1=1 /* comment */--.
• Purpose: Hide the true intent of the injected SQL code from detection mechanisms.

1.2 Encoding

• Definition: Encode the payload using various encoding schemes to evade detection.
• Types:
  • URL Encoding: Convert characters to their URL-encoded equivalents (e.g., %27 for ').
  • Hex Encoding: Use hexadecimal values (e.g., 0x27 for ').
  • Base64 Encoding: Encode payloads in Base64 (e.g., JTIxPTElM0El for 1=1).
• Example: 1' OR 1=1-- can be encoded as 1%27%20OR%201%3D1--.

1.3 Case Manipulation

• Definition: Alter the case of SQL keywords and operators.
• Example: SELECT can be written as sElEcT or SeLeCt.
• Purpose: Bypass simple pattern-matching filters.

1.4 String Concatenation

• Definition: Break up SQL keywords or payloads using string concatenation functions.
• Example: SELECT can be broken as CONCAT('SE', 'LECT').
• Purpose: Avoid detection by breaking up recognizable patterns.

2. Advanced Evasion Techniques

2.1 Dynamic SQL Injection

• Definition: Exploit SQL queries that are dynamically constructed at runtime.
• Example: Attacking a query that builds SQL commands using user input.
• Purpose: Bypass static query detection and filtering.

2.2 Blind SQL Injection

• Definition: Use techniques that do not return error messages but still manipulate the database.
• Types:
  • Boolean-Based Blind SQLi: Infer information based on changes in the response (e.g., AND 1=1 vs. AND 1=2).
  • Time-Based Blind SQLi: Measure the time taken for responses to infer data (e.g., SLEEP() function).
• Purpose: Extract information without visible data or errors.

2.3 Out-of-Band SQL Injection

• Definition: Use alternative channels (e.g., DNS or HTTP requests) to extract data.
• Example: Using functions like xp_cmdshell to make the database server contact an attacker’s server.
• Purpose: Bypass direct response-based filtering and detection.

2.4 Using Built-in Functions

• Definition: Exploit SQL built-in functions to gather information or manipulate queries.
• Example: Using UNION ALL SELECT to combine results from multiple queries or @@version to get database version.
• Purpose: Extract information without directly triggering detection mechanisms.

3. Other Evasion Techniques

3.1 Character Substitution

• Definition: Replace SQL keywords or special characters with alternative representations.
• Example: Replacing AND with +AND+ or using CHAR() function for character substitution.
• Purpose: Bypass keyword-based filters.

3.2 Using Alternative Syntax

• Definition: Exploit alternative SQL syntax or functions that achieve the same result.
• Example: Using SELECT * FROM INFORMATION_SCHEMA.TABLES instead of SELECT * FROM sysobjects.
• Purpose: Avoid detection by using less common SQL syntax or functions.

3.3 HTTP Parameter Pollution

• Definition: Inject malicious parameters into HTTP requests to alter the query.
• Example: Adding extra parameters to a URL or POST request to manipulate the SQL query.
• Purpose: Bypass input validation and filtering mechanisms.

3.4 Advanced Encoding Techniques

• Definition: Use more sophisticated encoding schemes to obscure payloads.
• Types:
  • Double Encoding: Encode the payload twice (e.g., %2527 for ').
  • Unicode Encoding: Use Unicode representations to obfuscate SQL keywords.
• Purpose: Evade detection by making the payload less recognizable.