OverviewStart here2 min
SQL Injection
In-band, blind and out-of-band attacks, and the defenses that stop them.
About this module
SQL injection is untrusted input breaking out of a database query and running as code — one of the oldest and most damaging web attacks. This focused build covers the eight topics that matter most: what SQLi is and why it works, its types, error- and UNION-based extraction, blind SQLi, authentication bypass, sqlmap, and the defenses that stop it.
What you will learn
- What SQL Injection Is & Why It Works
- Types of SQL Injection
- Error-Based SQLi
- UNION-Based SQLi
- Blind SQLi — Boolean & Time-Based
- Authentication Bypass
- SQLi Tools & Detection (sqlmap)
- Defenses: Parameterized Queries + WAF
Module roadmap
01What SQL Injection Is & Why It WorksLesson 1 · ~5 min
02Types of SQL InjectionLesson 2 · ~4 min
03Error-Based SQLiLesson 3 · ~4 min
04UNION-Based SQLiLesson 4 · ~5 min
05Blind SQLi — Boolean & Time-BasedLesson 5 · ~5 min
06Authentication BypassLesson 6 · ~4 min
07SQLi Tools & Detection (sqlmap)Lesson 7 · ~5 min
08Defenses: Parameterized Queries + WAFLesson 8 · ~5 min
09Lab: SQL Injection with sqlmapLab · ~40 min
10AssessmentAssessment · ~5 min
How to study: read each lesson in order, do the lab, then take the practice test and aim for 80%+.