Complete hands-on guide from beginner to expert level. This 22-chapter curriculum provides comprehensive coverage of SQL injection vulnerabilities across MySQL, PostgreSQL, MSSQL, Oracle, and SQLite.

• Detection & Fundamentals - Systematic approaches to identify injection points through error messages, boolean logic, and time-based delays.

• Data Extraction - Master UNION-based extraction, blind injection with binary search optimization, schema enumeration, and efficient dumping techniques for large datasets.

• Defense Evasion - Advanced WAF bypass techniques including case variation, comment injection, double URL encoding, hex concatenation, REVERSE() function obfuscation, and cutting-edge JSON SQL operator bypasses (@>, <@, JSON_EXTRACT) that exploit parser mismatches.

• Modern Attack Vectors - Exploit JSON APIs, XML/SOAP services, HTTP headers, cookies, JWT KID parameters, GraphQL resolvers, and ORM frameworks (Hibernate, Django, Sequelize).

• Specialized Techniques - Second-order stored injection, HTTP Parameter Pollution, heavy query DoS attacks, polyglot XSS+SQLi payloads, multibyte encoding bypasses (GBK, Big5, Shift-JIS), and NoSQL injection (MongoDB, Redis, Cassandra, Elasticsearch).

• System Compromise - File system operations, privilege escalation, and OS command execution via database functions.

Each chapter includes real-world scenarios, database-specific syntax, exploitation workflows, detection checklists, and defensive mitigation strategies. The cheat sheet provides quick reference for all payloads across database types.

Start here if you are new to SQL injection:

1. Guide/01-Introduction.md - Understand the vulnerability
2. Guide/02-Detection-Methods.md - Learn to find injection points
3. Guide/03-Basic-Exploitation.md - Extract data via errors and boolean logic

For penetration testers who need to extract data quickly:

4. Guide/04-Union-Injection.md - Fast extraction with UNION
5. Guide/05-Database-Fingerprinting.md - Identify your target
6. Guide/06-Schema-Enumeration.md - Map the database structure
7. Guide/07-Data-Extraction.md - Dump data efficiently

For advanced scenarios with WAFs or input filters:

8. Guide/08-Blind-Injection.md - When no output is visible
9. Guide/09-Filter-Evasion.md - Bypass WAFs and filters
10. Guide/10-Advanced-Techniques.md - Stacked queries and file operations

For red team operations and advanced exploitation:

11. Guide/10-Advanced-Techniques.md - File system access
12. Guide/11-OS-Command-Execution.md - Achieve command execution

For specialized scenarios and modern application architectures:

13. Guide/12-Second-Order-Injection.md - Stored/delayed injection attacks
14. Guide/13-Alternative-Context-Injection.md - JSON, XML, HTTP header, and cookie injection
15. Guide/14-HTTP-Parameter-Pollution.md - HPP attacks and framework bypass
16. Guide/15-Heavy-Query-DoS.md - Resource exhaustion and DoS via SQL

For niche attack surfaces and bypass techniques:

17. Guide/16-JWT-SQL-Injection.md - JWT KID parameter injection
18. Guide/17-GraphQL-SQL-Injection.md - GraphQL resolver injection
19. Guide/18-ORM-Injection.md - ORM framework bypass techniques
20. Guide/19-Polyglot-Payloads.md - Multi-context polyglot payloads
21. Guide/20-Multibyte-Encoding-Bypass.md - Character set encoding bypasses
22. Guide/21-NoSQL-Injection.md - MongoDB, Redis, Cassandra, Elasticsearch injection

• Basic SQL knowledge (SELECT, WHERE, JOIN)
• Understanding of HTTP requests and responses
• Familiarity with command line tools

docker run --rm -it -p 80:80 vulnerables/web-dvwa
# Login: admin / password
# Set security level to "low" or "medium"

1. Follow the order: Each chapter builds on previous knowledge
2. Practice immediately: Set up a lab and test every payload
3. Take notes: Document what works and what does not
4. Use the cheat sheet: Keep Guide/22-Cheat-Sheet.md open while testing
5. Be ethical: Only test on systems you own or have explicit permission to test

IMPORTANT: This material is for authorized security testing and educational purposes only.

• Never test on systems without explicit written permission
• Unauthorized access to computer systems is illegal in most jurisdictions
• Always follow responsible disclosure practices
• Use isolated lab environments for learning

This project is licensed under the MIT license. See the LICENSE file for details.