SQL Injection Detection with Burp Suite

SQL injection attacks are one of the biggest threats to web applications. They can expose, alter, or delete sensitive data if not addressed. This article explains how Burp Suite helps detect and fix these vulnerabilities.

Key Takeaways:

What is SQL Injection? It occurs when attackers insert malicious SQL code into input fields to exploit databases.
Common Types: Error-based, Union-based, and Blind SQL injections.
Burp Suite Tools for Detection:
- Proxy: Intercept and edit HTTP requests.
- Scanner: Automatically find vulnerabilities.
- Intruder: Automate payload testing.
- Repeater: Manually test and confirm vulnerabilities.
Steps to Detect SQL Injection:
1. Identify input fields using Burp Proxy.
2. Test manually with SQL payloads (' OR '1'='1).
3. Automate testing with Burp Scanner and Intruder.
4. Validate findings with Repeater.
Fixing Vulnerabilities: Use parameterised queries, input validation, and database hardening.

Quick Overview:

Phase	Action	Outcome
Setup	Configure Burp Suite and proxy settings	Ready for testing
Detection	Test inputs manually and with Burp tools	Identify SQL injection points
Validation	Confirm vulnerabilities with Repeater	Ensure accuracy
Remediation	Apply security fixes like prepared statements	Protect the application from attacks

Burp Suite simplifies SQL injection testing, making it easier to secure your web applications. Learn how to use its tools effectively and keep your systems safe.

SQL Injection: The Ultimate Guide Using Burp Suite

Before You Start

To effectively detect SQL injection using Burp Suite, you need the right skills and setup.

Required Skills

Testing for SQL injection demands a strong understanding of the following:

Skill Area	Required Knowledge	Importance Level
SQL Basics	Familiarity with SELECT, INSERT, and UPDATE statements	High
Web Technologies	Knowledge of HTML, HTTP methods, and the request/response cycle	Critical
Network Concepts	Basics like proxy settings, SSL/TLS, and ports	Medium
Security Fundamentals	Understanding authentication and session management	High

These skills form the backbone of effective testing. Specifically, make sure you’re comfortable with:

The structure of database queries and commonly used SQL syntax.
HTTP request methods like GET, POST, PUT, and DELETE.
Manipulating web forms and parameters.
Networking basics, especially for configuring proxies.

Once you’ve got these covered, you’re ready to set up Burp Suite.

Burp Suite Installation

Download the Burp Suite Community Edition from the official PortSwigger website. The installation process depends on your operating system:

Windows: Run the .exe file.
Linux: Use the Java Runtime Environment to execute the JAR file.
macOS: Mount the DMG file and drag the application to the "Applications" folder.

After installation, configure your browser to work with Burp Suite:

Install the Burp Suite CA certificate.
Set your proxy settings to localhost:8080.
Adjust your browser (Firefox or Chrome) to accept the custom certificate.

When you launch Burp Suite, make sure to configure the following:

Target Scope: Define the limits of your testing area.
Proxy Listeners: Ensure they’re set up correctly.
Scanner Settings: Adjust these for better performance.

Finding SQL Injection with Burp Suite

Monitoring Web Traffic

Start by configuring Burp Suite’s proxy settings and ensuring they are correct:

Setting	Configuration	Purpose
Proxy Interface	127.0.0.1:8080	Intercept local traffic
Intercept	ON	Capture requests and responses
Target Scope	Domain-specific	Narrow down testing scope

Once configured, visit the target webpage. Requests should appear in the Proxy > HTTP History tab. Pay close attention to forms and input fields, as these often interact with databases.

Testing Input Fields for Vulnerabilities

Focus on common entry points where SQL injection might occur:

Login Forms: Inject SQL metacharacters like ', ", ;, and -- into username and password fields.
Search Boxes: Use SQL fragments such as ' OR '1'='1 to check input validation.
URL Parameters: Test GET parameters for vulnerabilities, especially those tied to database queries.

Look for signs like error messages, unexpected behaviour, or changes in page content. If you observe anything unusual, proceed to automated testing using Burp Scanner.

Automating with Burp Scanner

After manual testing, streamline your search for vulnerabilities with Burp Scanner. Follow these steps:

1. Set Up the Scanner

In the Scanner tab, configure the following:

Scan type: Active
Insertion points: Custom (focus on specific parameters)
Attack intensity: Thorough

2. Run the Scan

Burp Scanner will test for injection patterns, analyse responses, identify vulnerabilities, and generate a detailed report.

3. Review the Results

Check the Issues tab for a breakdown of the findings. Vulnerabilities are categorised as follows:

Severity Level	Description	Recommended Action
High	Confirmed SQL injection	Fix immediately
Medium	Possible vulnerability	Conduct further manual tests
Low	Suspicious activity detected	Consider a code review

Burp Suite provides detailed insights for each issue, including:

The exact injection point
The payload that triggered the response
Evidence supporting the vulnerability
Suggested steps to address the problem

Testing with Burp Intruder

Once you’ve identified potential SQL injection points, you can use Burp Intruder to automate payload delivery and test for vulnerabilities. This tool allows you to test multiple injection points systematically while maintaining precise control over the process.

Setting Up Intruder

Select Target Request

Go to the Proxy History tab and find a request that interacts with the database. Right-click on it and choose "Send to Intruder". This will create a new Intruder tab containing your selected request.

Configure Attack Points

In the Positions tab:

Clear any automatic markers and focus on database-related parameters.
Add payload markers (§) around the values you want to test.
Choose an attack type based on your needs:
- Sniper: For testing one parameter at a time.
- Pitchfork: For testing multiple parameters simultaneously.

Attack Type	Use Case	Performance Impact
Sniper	Single parameter testing	Low to Medium
Battering Ram	Same payload in multiple positions	Medium
Pitchfork	Different payloads in multiple positions	Medium to High
Cluster Bomb	All payload combinations	Very High

Once configured, you’re ready to test your payloads.

Running Payload Tests

After setting up Intruder, you can select your payloads and fine-tune the processing settings.

Select Payload Set

Choose from pre-built or custom SQL injection payloads, such as:

Simple SQL metacharacters: ', ", ;
Boolean-based payloads: AND 1=1, OR 1=1
Time-based payloads: WAITFOR DELAY '0:0:5'
Error-based payloads: CONVERT(int, @@version)

Configure Payload Processing

Adjust rules to ensure payload compatibility:

URL encode special characters.
Add custom prefixes or suffixes if needed.
Match case sensitivity.
Handle any specific encoding requirements.

Execute and Analyse

Run the attack and monitor the results by analysing:

Response codes: Look for unusual codes like 500 errors.
Response times: Check for delays indicating time-based injections.
Response lengths: Look for variations compared to the baseline.
Response content: Identify changes, especially error messages or unexpected outputs.

Response Indicator	What to Look For
Status Codes	Errors like 500
Response Length	Variations from baseline
Response Time	Noticeable delays
Content Changes	Database errors or unexpected output

Pay special attention to responses that deviate from the baseline, such as database error messages, altered query results, or delayed responses. These variations can indicate potential vulnerabilities.

Security Fixes and Reports

When SQL vulnerabilities are identified using Burp Suite, they should be documented and resolved without delay.

Recording Test Results

Each vulnerability should be recorded with key details like the request/response pair, payload used, impact analysis, and severity based on the CVSS score.

1. Document Findings

Ensure the following evidence is captured:

Request and response pairs, supported by screenshots
Details of the successful payload
Assessment of the impact and potential data exposure
Severity rating using the CVSS framework

2. Standardise Documentation

Use a consistent format to document vulnerabilities:

Component	Required Details
Vulnerability ID	A unique identifier for tracking
Discovery Date	Use the DD/MM/YYYY format
Attack Vector	Specify the input parameter and method used
Proof of Concept	Include the payload and corresponding response
Risk Assessment	Rate the risk as Critical, High, Medium, or Low

Include detailed reproduction steps, such as the initial request, injection point, tested payloads, and observed results. Once documentation is complete, proceed with the targeted fixes outlined below.

Security Fixes

To guard against SQL injection, implement the following measures:

1. Parameterised Queries

Avoid string concatenation in SQL queries. Instead, use prepared statements, as shown below:

// Avoid this:
String query = "SELECT * FROM users WHERE id = " + userId;

// Use this:
PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users WHERE id = ?");
stmt.setString(1, userId);

2. Input Validation

Enforce strict input validation to minimise risks:

Validation Type	Implementation
Numeric Fields	Validate for digits only and check value ranges
String Fields	Use a whitelist for characters and set length limits
Date Fields	Ensure proper format and validate ranges
Special Fields	Apply custom regular expressions

3. Database Hardening

Enhance database security by following these practices:

Limit database user privileges to the minimum needed.
Apply security patches and updates regularly.
Use stored procedures where applicable.
Suppress error messages in production environments to prevent information leakage.

4. Web Application Firewall

Configure your Web Application Firewall (WAF) to block:

SQL keywords appearing in unexpected contexts
Repeated query attempts
Known malicious patterns
Unusual or suspicious character sequences

Summary

Main Points

Here’s a quick recap of the key phases involved in detecting SQL injection using Burp Suite:

Phase	Steps	Outcomes
Preparation	Configure proxy, install SSL certificates	Testing environment is ready
Detection	Intercept requests, analyse parameters	Entry points are identified
Testing	Validate inputs, analyse responses	Vulnerabilities are confirmed
Remediation	Implement security measures, set up WAF	Application is protected

To detect SQL injections effectively, make sure to:

Test input parameters carefully.
Keep detailed records of your findings.
Examine application responses thoroughly.
Apply security fixes as soon as possible.

These phases provide a solid foundation. To improve further, focus on mastering tools and refining your testing methods.

Next Steps

To strengthen your application security and build your expertise, concentrate on the following areas:

Skills Enhancement
- Dive deeper into advanced Burp Suite features.
- Develop custom payloads for testing.
- Learn techniques like database fingerprinting.
- Write clear and actionable security reports.

Practical Implementation

Focus Area	Recommended Action
Testing	Follow a structured testing process.
Tools	Utilise advanced features in Burp Suite.
Documentation	Standardise your reporting format.
Security	Adopt layered security measures.

Ongoing Development
- Keep up with new SQL injection techniques.
- Stay updated on Burp Suite’s latest features.
- Monitor emerging security threats.
- Align your practices with industry standards.

Training at MATE

Security Courses

MATE offers a 6-month Cyber Security course that focuses on detecting SQL injection attacks using Burp Suite. This programme prioritises practical learning through real-world projects. Priced between ₹75,000 and ₹1,00,000, it has received a solid rating of 4.5/5. It expands on the SQL injection detection techniques mentioned earlier, equipping students with practical and actionable skills.

Course Highlights

Here’s what makes MATE’s program stand out:

Practical Training: Get hands-on experience with industry-standard tools and work on real-world projects guided by experts.
Flexible Scheduling: Choose batch timings that fit your routine, with access to recorded sessions for added convenience.
Recognised Certification: Earn an industry-recognised certification upon completion, boosting your credentials.

The course is designed to provide a strong understanding of web security, with a focus on SQL injection detection.