Mastering Kali Linux for Web Penetration Testing

In-band or classic SQLI

In-band SQLI is the easiest and most common mode of SQLI, often referred to as the classic SQLI type. In-band better describes the way the attack is carried out. In-band SQLI involves both launching the attack (nefarious SQL queries) and receiving the response (that query's results) via the same channel. Hackers can use these attacks in a couple of ways.

• Error-based SQLI: Hackers can probe an application with strings that are meant to error out of the responses that reveal much about the structure and policies of the website but help map out and enumerate the database that the application is using. The example from Mutillidae below shows a statement that when injected in a request will induce a detailed error, which ...