Error-Based SQL Injection Challenge ⚠️

Error-based SQL injection is a technique where an attacker extracts information from the database by forcing it to generate error messages that contain sensitive data. Unlike blind injection, error-based attacks can extract data much faster because the information is directly visible in error messages.

This attack works by crafting SQL queries that cause database errors, and then using SQL functions to extract data that appears in those error messages. Common techniques include:

• Type conversion errors: Forcing type mismatches that reveal data
• Aggregate function errors: Using COUNT(), MAX(), MIN() with GROUP BY to extract data
• Mathematical errors: Division by zero or other operations that reveal values
• Function errors: Using functions that cause errors with data in the message

WARNING: In many countries (including UK) it is illegal to use this attack.

I've set up a vulnerable test system here so that you can have a go.

I promise not to prosecute.

The challenge on this page is to extract database information using error messages. Try the examples below in the search box to see how error-based injection works.

Note: SQLite handles errors differently than MySQL. Some MySQL-specific error-based techniques may not work the same way, but we can still demonstrate the concept.

Try These Error-Based Attacks:

How Error-Based Injection Works

Error-based SQL injection exploits database error messages to extract information:

• Type conversion errors: Attempting to convert incompatible types reveals the original value
• Aggregate function errors: Using GROUP BY with aggregate functions can cause errors that include data
• Mathematical errors: Division by zero or invalid operations reveal values

When a database throws an error, the error message often contains the data that caused the error, allowing attackers to extract sensitive information.

Note: SQLite's error handling is more restrictive than MySQL's, so some advanced error-based techniques may work differently. However, UNION-based extraction (which can trigger errors) still works effectively.