- Let's go over the different types
of sequel injection attacks or SQL injection attacks.
There are three main categories.
In-band, inferential, and out-of-band.
So starting with in-band, basically that's when
the attacker used the same channel to launch their attacks
and to gather their results, y'know,
with the web application, right?
And in this case, attacker can manipulate the database
or manipulate the application to cause some changes
in the database or to obtain records
from the database, or delete records, and so on.
Now there's a second category called inferential
or blind-sequel injection.
You hear this a lot as blind-sequel injection,
and this is actually when the attacker basically
sends the payload to the server, and to the web application
and then observes the response and the behavior
of the application to learn more about the structure
and the underlying technologies and the, y'know
underlying ecosystem of the application.
This is called blind-sequel injection
because the data is actually not transferred back
from the web application, or the database, to the attacker,
and the attacker cannot see information about the attack.
However, it can definitely manipulate the database
and it can potentially even delete records,
modify records, and so on.
Now there's a third category which is
the out-of-band attack, right?
The out-of-band sequel injection, or SQL injection attack,
and this is where the attacker can only carry
out this form of attack when certain features
are enabled on the database server and then use, y'know
by the web application and then basically the attacker
can manipulate that, y'know, vulnerable application.
I'm gonna put W1 for, y'know,
web application one, in here.
And then that application can send
an interact with another system, and I'm just gonna call it
X in here, that the attacker can potentially, y'know,
manipulate and obtain information from that web application.
So from the vulnerable web applications that typically,
the second system is controlled by the attacker
and the attacker can manipulate the application
to send that information to the out-of-band
secondary system.
So those are the general three types of SQL injection
or sequel injection attacks in-band, inferential or
blind-sequel injection, and out-of-band.