Running an SQL Injection Attack - Computerphile

Main ideas / lessons conveyed

• SQL injection is still a real-world threat: Large companies have been hit by SQL injection issues for years (the speaker references 2016), and successful exploitation can expose sensitive data.
• It’s both illegal and harmful: Doing this without authorization is illegal (leading to jail) and dangerous for users, businesses, and even the attacker.
• The demo is on the speaker’s own permitted site: The walkthrough is framed as being performed only with permission on the speaker’s own website.

Step-by-step methodology demonstrated (SQL injection attack flow)

1. Confirm whether the input is vulnerable

   • Enter a single quote (') into the search/input box.
   • Observe the behavior:
     • If the site errors (e.g., “server error”), it suggests the input is being placed into an SQL query without proper escaping.
     • If the single quote is not handled correctly, it indicates malformed SQL is being generated.

2. Infer the structure of the underlying SQL query

   • Conceptually model the query as something like:
     • SELECT ... FROM ... WHERE <column> LIKE '%<input>%';
   • The speaker illustrates that searching for “hammer” matches because the backend likely uses wildcards around the user input.

3. Break out of the SQL string and neutralize the rest of the query

   • Use an end-of-command plus comment approach, e.g.:
     • close the string,
     • end the SQL statement with something like a semicolon (;),
     • then add a comment marker so the rest of the original query is ignored.
   • Result: the attacker can sometimes force the query to return more (or all) rows.

4. Identify the DBMS (database engine)

   • Because SQL looks similar across engines (MySQL, SQL Server, Postgres), the speaker targets DB-specific functions/syntax.
   • The key goal: find which database is running so payloads match.

5. Use “time-based” blind SQL injection to test and learn

   • Inject a DB-specific sleep/delay so the server response time changes when the condition is true.
   • Example logic shown:
     • filter results for rows matching “hammer”
     • add a conditional like “wait N seconds” (via a DB function such as SLEEP(2) in MySQL)
   • Observation:
     • if the response slows by an expected amount (e.g., ~4 seconds for two matching rows), it indicates the payload is executed.
   • Even without visible output, timing can still reveal information.

6. Escalate to visible (non-blind) extraction using UNION

   • Determine the number of columns the original query returns (the speaker assumes 3 columns based on behavior).
   • Use UNION to append attacker-controlled rows to the legitimate results:
     • ... UNION SELECT 1,2,3 ...
   • Confirmation:
     • if the output displays “1 2 3” alongside legitimate “hammer” results, it proves the injection and column count.

7. Enumerate database metadata (table names, column names)

   • Query MySQL’s information schema metadata tables to discover:
     • available tables,
     • which columns belong to which tables,
     • the correct column names to make UNION work.
   • The speaker uses metadata lookups resembling:
     • tables listings (from an information schema “tables” metadata set),
     • columns listings (from an information schema “columns” metadata set).

8. Extract credentials from the users table

   • Once the relevant columns are known, output fields such as:
     • user login (username),
     • user hash (password hash),
     • user type (e.g., admin).
   • The speaker notes:
     • hashed passwords are extracted,
     • “admin” user types can help prioritize cracking.

9. Crack passwords offline (implied)

   • The speaker doesn’t fully crack passwords in the demo, but explains the typical next step:
     • obtain hashes,
     • use password cracking tools externally.
   • They caution that the demo likely uses non-real passwords (because it’s their own test system), but the overall process is what matters.

Security guidance mentioned (defenses and why they’re incomplete)

• Parameterize queries (prepared statements)
• Sanitize/escape input
• Be aware of second-order SQL injection: Even if injection characters are escaped at first input, unsafe stored values can later be reused as SQL and trigger execution later.
• Broader implication: Developers must ensure user credentials (hashes) and related data (e.g., email/address pairs) are not retrievable via injection.

Real-world context and risks highlighted

• Mass automated exploitation is possible
  • The speaker references an incident (TalkTalk) and describes that similar attacks can be automated via scripts that extract data rapidly.
• Stepping stones to other attacks
  • The demo ends with the idea that stolen session cookies or credentials could be used to access or manipulate other systems (e.g., retrieving shopping basket / personal data / payment details), illustrating downstream impact.

Speakers / sources featured

• Primary speaker: Tom Scott (referenced by name as the author of a prior Computerphile/related SQL injection video)
• Channel / video title source: Computerphile
• Other referenced real-world victim: TalkTalk (company hacked)
• Other named tech/library references (not speakers):
  • Python (mentioned as a scripting language used in an attack)
  • SQL dialects/engines: MySQL, SQL Server, Postgres