Testing for SQL injection

OK – now that you know the major types of injection attacks, let’s explore the one that is possibly the oldest while, at the same time, the most applied nowadays: injection on SQL databases. This kind of attack can vary from a very simple OR clause as part of user input to the complexity and sophistication of union and hidden union attacks, where multiple SQL statements can be combined to form an explosive payload. The first step, though, is not to attack the database behind the API endpoint but to fingerprint it. This can substantially reduce your effort in selecting techniques. By trying with some random input, you can force an unprepared API to return useful database error messages. Some engines reveal themselves in such error messages.

The following snippet shows a typical error message from Microsoft SQL Server:

Connection failed:
SQLState: '08001'
SQL Server Error: 21
[Microsoft][SQL Server Native Client 11.0]Client unable...