SQLi learning path

Orientation and first principles — what the bug class is and how it behaves.

1. SQL Injection - OWASP
   7 min readowasp.org2026
   Reference on SQL Injection attacks, detailing how attackers insert malicious SQL queries into application inputs to access, modify, or delete sensitive database data. It covers common attack vectors, the high severity risk associated with these vulnerabilities, and provides examples of exploitation in PHP, ASP, J2EE, and ASP.NET applications. The OWASP resource also points to prevention strategies like parameterized SQL statements and code review guides.
2. SQL Injection for Bug Bounty Hunters | YesWeHack
   12 min readyeswehack.com2026
   Guide on SQL injection techniques for bug bounty hunters, covering blind SQLi, time-based attacks, and out-of-band callbacks. It details how to tailor payloads to SQL statements, integrate detection into bug bounty workflows, and exploit SQLi even in hardened systems, referencing vulnerabilities like CVE-2022-21661 in WordPress.
3. PayloadsAllTheThings - SQL Injection
   13 min readgithub.com2026
   Reference detailing SQL Injection (SQLi) techniques, including entry point detection, DBMS identification, authentication bypass using tautologies and UNION queries, blind injection, error-based and timing attacks, and specific vulnerabilities like those affecting PDO prepared statements and WAF bypasses. It features tools such as sqlmap and ghauri, and discusses the impact of password hashing and salts on modern authentication bypass methods.
4. Preventing SQL injection attacks in Node.js
   8 min readsnyk.io2026
   Library for Node.js developers detailing SQL injection prevention techniques, including constructing vulnerable Express applications with PostgreSQL to demonstrate how user input manipulation leads to data leaks. It emphasizes using query placeholders and prepared statements with the `pg` library, validating and sanitizing input via `express-validator`, and utilizing tools like `npm audit` and the Snyk IDE extension for identifying known vulnerabilities in dependencies.
5. SQL Injection Cheat Sheet - Invicti
   18 min readinvicti.com2026
   Library of SQL injection payloads and techniques for MySQL, Microsoft SQL Server, Oracle, PostgreSQL, and SQLite, offering detailed technical information and attack vectors. This resource is useful for penetration testers and developers interested in web application security, covering exploitation methods like UNION attacks, blind SQL injection with IF statements and CASE expressions, hex value usage, string concatenation, and error-based injection, also noting the role of DAST tools like Invicti for automated detection.

Real testing methodology, tooling, and writeups that show the work.

1. Pentesting PostgreSQL with SQL Injections
   11 min readonsecurity.io2026
   Library for analyzing and exploiting SQL injection vulnerabilities specifically targeting PostgreSQL. It details bypass methods for web application firewalls, techniques for data exfiltration across various query clauses including SELECT, WHERE, FROM, and ORDER BY, and demonstrates how to exploit nested queries. The resource covers bypassing spaces, trailing data, quotation marks using dollar quoting or `CHR()` function, and utilizes time-based blind SQL injection with concatenation and conditional logic for data leakage.
2. MCP Vulnerability Case Study: SQL Injection in the Postgres MCP Server
   8 min readsecuritylabs.datadoghq.com2026
   Writeup on a SQL injection vulnerability in Anthropic's reference Postgres MCP server, allowing arbitrary SQL execution by terminating the read-only transaction with a `COMMIT;` statement. Though deprecated, the `@modelcontextprotocol/server-postgres` NPM package and `mcp/postgres` Docker image see significant weekly downloads. The vulnerability is patched in the Zed Industries fork (`@zeddotdev/postgres-context-server` v0.1.4) and an unreleased reference implementation. Users should avoid the deprecated server for sensitive data and consider the Zed Industries fork for mitigation.
3. SQLi Payloads - Classic, Blind, Error-Based, Time-Based, WAF Bypass
   13 min readgithub.com2026
   Library of SQL injection payloads and techniques, covering classic, blind, error-based, and time-based methods. Includes bypass strategies for Web Application Firewalls (WAFs) and showcases tools like SQLMap, jSQL Injection, BBQSQL, and NoSQLMap for exploitation and scanning. Techniques range from simple character injections and comments to advanced blind SQL-bitshifting and server-time-based attacks, with examples for MySQL, MariaDB, and more.
4. Exploiting an SQL Injection with WAF Bypass
   11 min readvaadata.com2026
   Tool for bypassing Web Application Firewalls (WAFs) to exploit SQL injection vulnerabilities. The process involves identifying a potential SQL injection using Burp Suite, confirming it manually via Burp Repeater, and then configuring sqlmap with specific techniques (`--technique=B`), exclusion strings (`--not-string`), proxy settings (`--proxy`), and modifying the User-Agent header to evade WAF detection. This enables successful exploitation of boolean-based blind SQL injection flaws.
5. SQL Injection and Postgres: An Adventure to Eventual RCE
   21 min readpulsesecurity.co.nz2026
   Library for leveraging PostgreSQL functions to achieve Remote Code Execution (RCE) via SQL Injection. This resource details exploiting an ORDER BY clause injection in a Flask application, demonstrating techniques for data exfiltration using error messages and the `query_to_xml` function to bypass row limitations and achieve command execution as the database user.

Novel research, edge cases, and the techniques that push the class forward.

1. SQL Injection 2025 Advanced Exploitation & Defense Guide
   46 min readbroadchannel.org2026
   Guide to advanced SQL injection exploitation and defense, detailing techniques like error-based, union-based, boolean-based, time-based blind, and out-of-band methods. It covers database-specific exploitation for MySQL and MSSQL, including file I/O, User-Defined Functions, and `xp_cmdshell`. The guide emphasizes the critical need for proper data sanitization and robust database security measures to prevent vulnerabilities such as CVE-2025-57423.
2. Snowflake SQL Injection via Compile-Time Constant Folding with SYSTEM$WAIT
   7 min readinfosecwriteups.com2026
   Library for exploiting Snowflake SQL injection vulnerabilities by leveraging compile-time constant folding with the SYSTEM$WAIT function. This technique forces errors during the compilation phase, rather than execution, allowing the extraction of sensitive information through verbose compilation error messages, bypassing application-level error handling that suppresses runtime failures.
3. NoSQL Injection: Advanced Exploitation Guide
   8 min readintigriti.com2026
   Guide to exploiting NoSQL injection vulnerabilities, detailing how improper input sanitization allows attackers to bypass authentication on MongoDB and other databases. It covers identifying injections by manipulating syntax and using operators like `$gt` and `$ne`, and demonstrates advanced techniques such as extracting data through time delays using the `$where` operator.
4. Second-Order SQL Injection with Stored Procedures and DNS-Based Egress
   14 min readnetspi.com2026
   Writeup detailing the detection and exploitation of a second-order SQL injection vulnerability, leveraging Out-of-Band (OOB) techniques via DNS exfiltration. The technique involves exploiting a Microsoft Excel report export feature where a crafted payload in the date parameter, when processed by the `xp_dirtree` stored procedure, triggers DNS requests to an attacker-controlled server. This allows for the disclosure of sensitive database information, including usernames and tables, by chaining SQL Server UNC Path Injection with DNS-based data exfiltration.
5. Advanced SQL Injection Techniques in Modern Web Apps
   2 min readgauravsingh-cybersecurity.github.io2026
   Writeup detailing advanced SQL injection techniques like second-order, time-based blind, and WAF bypasses through encoding and case variation. It emphasizes prevention strategies such as parameterized queries, strict input validation, and least privilege for database users, and mentions tools like SQLi Detector for automated testing, highlighting real-world applications in e-commerce platforms, CMS systems, and API endpoints.
6. From SQL Injection to Infrastructure-Level RCE: A PostgreSQL Superuser Compromise
   1 min readinfosecwriteups.com2026
   Writeup detailing a PostgreSQL superuser compromise, initiated by an SQL injection vulnerability in the `pJobNumber` parameter of a financial management web portal (`vsswb`). The exploit chain demonstrates unauthenticated Remote Code Execution (RCE) by leveraging `UNION SELECT` to extract database version and user information, revealing the application's use of the native `postgres` account. This superuser access allows for mass data exposure, including PII from tables like `public.vss01tpemployee`.
7. Advanced Boolean-Based SQLi Filter Bypass Techniques
   3 min readsecjuice.com2026
   Technique for bypassing libinjection filters in Web Application Firewalls using advanced boolean-based SQL injection. This method leverages MySQL string functions like `INSERT`, `REPEAT`, `REPLACE`, `RIGHT`, `WEIGHT_STRING`, conditional constructs such as `IF` statements, and the `RLIKE` operator for bruteforcing hashed passwords. It also incorporates comments and assignment operators (`:=`) within SQL syntax to evade detection by security tools.
8. Advanced SQL Injection Cheatsheet
   github.com2022
   Cheatsheet detailing advanced SQL injection techniques. It covers finding injection points, understanding website behavior, enumerating data, bypassing Web Application Firewalls (WAFs), and dumping databases. Methodologies include Error- or UNION-based, Boolean-based (content-based) Blind SQLi, and Time-based SQLi, along with stabilizing injections and bypassing whitespace filters. Privilege escalation and Local File Inclusion (LFI) are also addressed.