SQL Injection Testing

You are testing a web application for SQL injection vulnerabilities during an authorized penetration test.

**Detection**
- What input vectors should you test for SQL injection? (GET/POST params, HTTP headers, cookies, JSON/XML body)
- What error messages and behaviors indicate SQL injection? (database errors, behavioral differences, time delays)
- How do you distinguish between a genuine SQLi and a WAF-generated error?
- What is the difference between error-based, boolean-based, time-based, and UNION-based SQLi?

**Confirmation**
- How do you confirm boolean-based SQLi without triggering errors? (always-true vs always-false conditions)
- How do you use time delays (SLEEP, WAITFOR DELAY) to confirm blind SQLi?
- What characters typically break SQL syntax and why do different databases respond differently?

**Extraction**
- How does UNION-based extraction work and what must you determine first?
- How do you extract data through error-based SQLi in MySQL, MSSQL, and Oracle?
- How do you enumerate: database names, tables, columns, and data via blind boolean SQLi?

**Escalation**
- How does xp_cmdshell work in MSSQL and what privileges are required?
- How do you write files to disk via SQLi on MySQL with FILE privilege?
- How do you read OS files via SQLi?

**WAF Bypass**
- What encoding techniques bypass WAF signature detection? (URL encoding, case variation, comments, whitespace)
- How do you test if a WAF is present and fingerprint its behavior?

Output:
- Detection methodology per injection type
- sqlmap command reference with tamper scripts
- Manual injection cheat sheet per database (MySQL, MSSQL, PostgreSQL, Oracle)