SQL Injection — UNION, Blind, and Time-Based Attacks

SQL injection is not a single trick but a family of techniques an attacker escalates through depending on what the application reveals. When the app echoes query results, a UNION-based attack pulls out extra data directly. When it shows only success or failure, blind techniques infer data one answer at a time. When it shows nothing at all, timing becomes the channel.

Analogy🏏Cricket

🍳 Think of it like cooking: A recipe can look flawless on paper, but a head chef only truly judges the dish by tasting the finished plate, because heat, timing, and the actual oven reveal problems the written method never shows. Just as tasting the cooked result catches what reading the recipe cannot, DAST probes the running application and catches the misconfigurations and runtime behaviour that reading the source cannot. This reveals DAST's stance: it judges the dish as it is actually served, not the recipe as it was merely written.

Understanding this progression matters because it explains why partial defences fail. Hiding error messages stops naive attacks but not blind ones; a page that merely loads differently, or loads more slowly, still leaks every byte of your database given patience. This lesson walks the ladder of techniques so the single real fix, parameterisation, is clearly the only complete answer.

Analogy🏏Cricket

💰 Think of it like finance: A real audit that actually attempts a sample transaction proves beyond doubt whether a control can be bypassed, with little room for a false alarm, but it can only test the accounts and processes the auditors actually reach. Just as a hands-on audit yields high-confidence, low-false-positive results yet is bounded by what it examines, DAST yields high-confidence findings about real exploitability yet is bounded by the surface it can reach. This reveals its trade-off: what it confirms is solid, but it only confirms what it manages to touch.