There are a number of reasons why bug bounty hunters would use SQL injection to generate a proof of concept (POC) report:
- Stealing information: A simple POC for a SQL injection attack would be to steal information, such as simple usernames and passwords, and show them as proof of concept to the program owners.
- Feeding false information: When a simple information theft is not sufficient for the program owners and something else is required, it is crucial that you feed false information or update some tables.
- Taking over control: Sometimes, to acquire more bounty and to make your bug bounty report comprehensive, it is important that you show how the SQL injection can be chained to own a machine or gain access to the system.
SQL injection is basically the injection of unauthorized code in SQL statements and it is one of the...
