Exploiting a SQL injection to extract data
In this section, we're going to learn how to exploit SQL injections and how to alternate this in Python. We're going to learn what kind of data we can extract with an SQL injection, and then we're going to alternate some of these techniques, such as automating basic data extractions in our SQL injector script from the previous section.
What data can we extract with an SQLi?
Once we identify a valid SQL injection, it's time to decide what we're going to look for. Here, we have a list of the most typical things:
- Basic data: For example, database version, user running the database, current database, database directory, and so on
- Advanced data: MySQL usernames and passwords, databases, table names, column names, and content from tables
- OS files: We can read any file in the file system as long as the user running the database has privileges
Note
These are some of the most useful and typically extracted data. I encourage you to continue learning what other things...
