> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/ewptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/ewptv2-notes/readme/system-security-2.md).

# 5 - ​SQL Injection (SQLi)

## SQL Injection

### Topics

> 1. [DB & SQL Introduction](/ewptv2-notes/readme/system-security-2/5.1-db-and-sql-introduction.md)
> 2. [SQL Injection (SQLi)](/ewptv2-notes/readme/system-security-2/5.2-sql-injection-sqli.md)
> 3. [In-Band SQL Injection](/ewptv2-notes/readme/system-security-2/5.3-in-band-sqli.md)
> 4. [Blind SQLi](/ewptv2-notes/readme/system-security-2/5.4-blind-sqli.md)
> 5. [NoSQL](/ewptv2-notes/readme/system-security-2/5.5-nosql.md)
> 6. [SQLMap](/ewptv2-notes/readme/system-security-2/5.6-sqlmap.md)
> 7. [Mitigation Strategies](/ewptv2-notes/readme/system-security-2/5.7-mitigation-strategies.md)

<details>

<summary>SQLi</summary>

**SQL Injection (SQLi)** is an attack method that exploits the injection of SQL commands into a web application's SQL queries. A successful SQLi attack allows a malicious hacker to access and manipulate the backend database of a web application.

Web applications, ranging from complex systems to Content Management Systems (CMSs) and simple personal web pages, often utilize databases like MySQL, SQL Server, Oracle, PostgreSQL, and others to store data, user credentials, or statistics. Structured Query Language (SQL) is employed by entities such as system operators, programmers, applications, and web applications to interact with databases.

SQL, a powerful interpreted language, is used to extract and manipulate data from databases. Web applications embed SQL commands, known as queries, in their server-side code, with connectors serving as middleware between the web application and the database.

Before delving into attack techniques, understanding some SQL basics is essential. This includes knowledge of SQL statement syntax, query execution, union operations, the DISTINCT and ALL operators, and how comments function.

</details>

{% embed url="<https://owasp.org/www-community/attacks/SQL_Injection>" %}

### Web Basics

* ​[Web Application Basics](https://attackdefense.com/listing?labtype=webapp-web-app-basics\&subtype=webapp-web-app-basics-getting-started)​
* ​[Web Apps Tools of Trade](https://attackdefense.com/listing?labtype=webapp-tools-of-trade\&subtype=webapp-tools-of-trade-getting-started)

{% content-ref url="/spaces/iS3hadq7jVFgSa8k5wRA/pages/wH5bw6a9Xx1F2NPZKw0B" %}
[14 - Hacking Web Apps](https://dev-angelist.gitbook.io/practical-ethical-hacker-ceh-tools/practical-ethical-hacker-notes/main-contents/14-hacking-web-apps)
{% endcontent-ref %}

{% content-ref url="/spaces/iS3hadq7jVFgSa8k5wRA/pages/mZTJKDwQNJa4ABUvs4kB" %}
[15 - SQL Injection](https://dev-angelist.gitbook.io/practical-ethical-hacker-ceh-tools/practical-ethical-hacker-notes/main-contents/15-sql-injection)
{% endcontent-ref %}

### Practise

🔬 There are many vulnerable testing web apps like:

* ​[Juice Shop - Kali Install](https://www.kali.org/tools/juice-shop/)​
* ​[DVWA - Kali Install](https://www.kali.org/tools/dvwa/)​
* ​[bWAPP](http://www.itsecgames.com/)​
* ​[Mutillidae II](https://github.com/webpwnized/mutillidae)

<details>

<summary>DVWA</summary>

**The Damn Vulnerable Web Application (DVWA)** is a web application built with PHP and MySQL intentionally designed to be susceptible to security vulnerabilities. Its primary purpose is to serve as a resource for security professionals to assess their skills and tools within a legal context. Additionally, it aids web developers in gaining a deeper understanding of the processes involved in securing web applications and facilitates learning about web application security for both students and teachers in a controlled classroom setting.

DVWA is designed to provide a platform for practicing various common web vulnerabilities at different difficulty levels, all presented through a simple and user-friendly interface. It's important to note that there are deliberate both documented and undocumented vulnerabilities within the software, encouraging users to explore and identify as many issues as possible.

</details>

{% embed url="<https://github.com/digininja/DVWA>" %}
DVWA
{% endembed %}

#### DVWA - My Writeups

{% content-ref url="/spaces/rRWtuMw6xkkeDjZfkcWC/pages/EmtcnjNj2v4e1aU5r83h" %}
[DVWA](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/dvwa)
{% endcontent-ref %}

#### Theory and Lab platform

{% embed url="<https://portswigger.net/web-security/all-labs>" %}
Web Burp Suite Security Academy
{% endembed %}

{% hint style="danger" %}

#### ❗ Disclaimer

**Never use tools and techniques on real IP addresses, hosts or networks without proper     authorization!**❗
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://dev-angelist.gitbook.io/ewptv2-notes/readme/system-security-2.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.