CEH v13: SQL Injection
Table of Contents
Click Here to Return To the Certified Ethical Hacker (CEH v13) Course Page
SQL Injection is a dedicated module in the EC-Council CEH v13 course. This module covers injecting database commands through application input and the defenses that stop it. Test injection only against applications inside your authorized scope.
SQL injection happens when an application builds a database query from user input without sanitizing it. You insert SQL that the database runs as part of the query, which exposes or alters data.
Types of SQL Injection
| Type | How you get results |
|---|---|
| In-band | Results return in the page (UNION, error-based) |
| Blind | No direct output, you infer from true/false or time |
| Out-of-band | Data leaves through DNS or HTTP channels |
Error-based injection reads database errors. UNION-based injection appends a second query to merge attacker data into the result.
Authentication Bypass
A login form that builds a query from input is a classic target.
-- Input that turns the WHERE clause always true
' OR '1'='1' --
When the application inserts this into a login query, the condition is always true and the comment sequence -- ignores the rest, which logs you in without a valid password.
Automating with SQLMap
You confirm and exploit injection points quickly with SQLMap.
# Detect injection and enumerate databases
sqlmap -u "http://target.example/item?id=1" --dbs
sqlmap -u "http://target.example/item?id=1" -D appdb --tables
SQLMap fingerprints the database, extracts schemas and tables, and dumps credentials when a parameter is vulnerable.
Defenses
You stop injection at the code level.
- Parameterized queries (prepared statements) separate code from data.
- Stored procedures with bound parameters reduce risk.
- Input validation constrains expected types, ranges, and allowed identifiers. Do not rely on character filtering as the sole defense.
- Least privilege limits what a compromised query reaches.
Bound parameters protect values in supported query positions. They do not safely parameterize table names, column names, or query structure. Choose identifiers from an allowlist, avoid dynamic SQL where possible, and test each query path. Stored procedures remain vulnerable when they concatenate untrusted input into SQL.
Next Steps
Move off the wire and into the air with Hacking Wireless Networks . Revisit the broader application surface in Hacking Web Applications . Return to the Certified Ethical Hacker (CEH v13) Course .
