Rolling Thunder Security · Module 05 · SQL Injection

05.02 — Classic Injection Attacks

Tautologies, comments, numerics, and wildcards
Lab Progress
0 / 4

Classic Injection Techniques

Now that you understand how SQL injection works, let us examine the four foundational attack patterns that form the basis of every SQLi exploitation.

1. Tautology-Based Attacks

A tautology is a statement that is always true. By injecting OR 1=1 into a WHERE clause, you make the entire condition evaluate to true for every row. This is the most common way to bypass authentication or dump entire tables.

-- Original query SELECT * FROM users WHERE user='admin' AND pass='secret' -- With tautology injection in username field SELECT * FROM users WHERE user='' OR 1=1 --' AND pass='anything'

2. Comment Injection

SQL comments (-- or #) truncate the rest of the query. This is devastating when combined with a known username because it removes the password check entirely.

-- Injecting: admin' -- SELECT * FROM users WHERE user='admin' -- ' AND pass='anything' -- ^^^ everything after -- is ignored

3. Numeric Injection

When the injection point is a numeric field (like an ID), the value is not wrapped in quotes. This means you do not even need to escape a string — you can inject SQL directly without a leading single quote.

-- Original: id comes from user with no quotes SELECT * FROM orders WHERE id = 1 OR 1=1

4. LIKE Clause Manipulation

The LIKE operator uses % as a wildcard (match anything). By injecting wildcards and tautologies into LIKE-based searches, you can match every row regardless of the intended filter.

LAB 1 Tautology Bypass

Acme Corp's employee portal has a login form. The server checks credentials by running a SQL query that matches both username and password. If the query returns any rows, the user is authenticated.

SELECT * FROM users WHERE username='[USERNAME]' AND password='[PASSWORD]'
Challenge

Log in to Acme Corp without knowing any password. Use a tautology attack in the username field to make the WHERE clause always true.

Strategy: In the username field, close the string, add a tautology, and comment out the rest.

Try username: ' OR '1'='1' --
Password: anything (it will be commented out)

The -- comments out AND password='...', and OR '1'='1' makes the WHERE always true.
COMPLETE — Tautology bypass achieved! You logged in without a password.
LAB 2 The Comment Trick

Same Acme Corp login form. This time, your goal is more specific: log in as the admin user. You know the username is admin but you do not know the password.

SELECT * FROM users WHERE username='[USERNAME]' AND password='[PASSWORD]'
Challenge

Log in as the admin user specifically. The lab will only accept a solution that authenticates you as admin (role = "admin"). Use SQL comments to eliminate the password check.

Key insight: If you use admin' -- as the username, the query becomes:
WHERE username='admin' -- ' AND password='...'

Everything after -- is a comment. The password check vanishes completely. The query now only checks if username = 'admin'.
COMPLETE — You logged in as admin by commenting out the password check!
LAB 3 Numeric Injection

Acme Corp's order tracking page lets customers look up orders by ID. The developer used a numeric parameter without quotes, assuming only numbers would be entered.

SELECT * FROM orders WHERE id = [YOUR INPUT]
Challenge

The input is numeric — no quotes surround it. Exploit this to return all orders in the database, not just your own. You do not need a single quote for this one.

Key difference: Numeric fields have no quotes, so you do not need to escape a string. Just append a tautology directly.

Try: 1 OR 1=1
This becomes: WHERE id = 1 OR 1=1 — true for every row.
COMPLETE — Numeric injection revealed all orders!
LAB 4 Wildcard Warfare

Acme Corp's product page lets you browse by category using a LIKE search. The category filter is supposed to narrow results, but you can use it to see everything.

SELECT name, price FROM products WHERE category LIKE '%[YOUR INPUT]%'
Challenge

Return all 6 products from every category. The LIKE clause uses wildcards — find a way to make it match everything.

Approach 1 (tautology): %' OR '1'='1' -- — close the string, add tautology, comment out the rest.

Approach 2 (tautology): %' OR 1=1 --

Approach 3 (simple): Just type nothing and see what matches with the existing %% wrapper. If that returns all rows, you may not even need injection. (It will, since % matches everything!)
COMPLETE — Wildcard warfare mastered!