Web Security PRO · Free worksheet

Your first SQL injection test

One lab, five questions. Work through the full UNION SQL injection demo and connect what you see in the application to the HTTP request and database query.

Work only in the prepared demo. This is an exercise worksheet, not authorization to test other applications or a complete pentesting methodology.

1. What should work normally?

   Open a normal product. Find the id parameter in the HTTP request, its corresponding SQL condition, and the product name and price on the page.

   Record: where the parameter value comes from, which two columns the query selects and what you expect in the response.

2. When does data change the query?

   Follow the tutor through examples of ORDER BY and UNION SELECT. Compare an incorrect column count with a matching query. In this exercise, the code concatenates user input with the SQL statement.

   Record: the changed input fragment, expected result and what the error or successful execution proves. Absence of an error alone does not prove data disclosure.

3. Does data really leave the database through the application?

   Compare the SQL console result with the HTTP response body and product page. This page model displays one row. Check the difference between an existing product identifier and a nonmatching id, then trace successive rows as the lesson explains.

   Record: which data appeared in the application response. The SQL console provides extra insight for learning, not proof that an attacker has direct database access. Do not equate one visible row with disclosure of the entire table.

4. Does the fix remove the cause?

   Repeat the UNION attempt in the protected version. Then read a normal product. Parameterization should treat input as a value, not an additional SQL instruction.

   Record: the attack attempt and legitimate read results. No exposed data is not enough if the fix also breaks normal shop behavior.

5. Can you predict your own variation?

   Choose one of 18 Sandbox variations. Predict the outcome, run the test and compare results. Also test your own valid query against the prepared tables in the SQL console. If the result surprises you, revisit the input, query and display behavior.

   Complete: "I changed ..., the application built ..., and the response showed ... . This confirms ..., but does not prove ...".

One exercise is a starting point

Web Security PRO develops this analysis across 132 labs: access control, sessions, SQL injection, XSS and other vulnerability classes. The first edition covers technical practice, without extra end-to-end engagement modules.

Notify me about the first edition

The worksheet and demo are free, with no email required. Signup is for course launch and offer information.