How to learn SQL injection

In my previous post in the hacker series , we noted that SQL Injection remains a top method for security vulnerabilities. Accordingly- here is a list of resources to learn SQL Injection



Basic Tools

  • SQL Inject Me

SQL Inject Me is the Exploit-Me tool used to test for SQL Injection vulnerabilities.

The tool works by submitting your HTML forms and substituting the form value with strings that are representative of an SQL Injection attack.The tool works by sending database escape strings through the form fields. It then looks for database error messages that are output into the rendered HTML of the page.

The tool does not attempting to compromise the security of the given system. It looks for possible entry points for an attack against the system. There is no port scanning, packet sniffing, password hacking or firewall attacks done by the tool.

  • Hackbar



  • SQLMap


Basic Tutorials ( in order of learning)

A site for testing SQL Injection attacks. It is a test system and can be used for honing your SQL Skills.


Intermediate Tutorials on End to End SQL Injection

Step 1: Finding Vulnerable Website:

Step 2: Checking the Vulnerability:


If you got an error message , then it means that the site is vulnerable

Step 3: Finding Number of columns:

Step 4: Find the Vulnerable columns:

Step 5: Finding version,database,user

Step 6: Finding the Table Name

Step 8: Finding the Admin Panel:



  • Next Tutorial uses an automated tool called Havij  from

and the tutorial is at

Hacking for Beginners- Top Website Hacks


However a more recent list of hacks is here-

The Top Ten

  3. Chrome addon hacking (2345)
  4. Bruteforce of PHPSESSID
  5. Blended Threats and JavaScript
  6. Cross-Site Port Attacks
  7. Permanent backdooring of HTML5 client-side application
  8. CAPTCHA Re-Riding Attack
  9. XSS: Gaining access to HttpOnly Cookie in 2012

Honorable Mention

11. Using WordPress as a intranet and internet port scanner



14. Browser Event Hijacking (23)




  • A1 Injection
  • A2 Broken Authentication and Session Management (was formerly A3)
  • A4 Insecure Direct Object References
  • A5 Security Misconfiguration (was formerly A6)
  • A10 Unvalidated Redirects and Forwards


Countering Communist China’s CyberWar

How the West Counters China


How China can counter the West

  • Highlight Western Government’s breaches of citizen privacy and digital surveillance
  • Support Anonymous and Digital Activism as potential allies
