## 4 Experimentation
### SQL Injection Attack  
The self-generating vulnerability covered in this study consists of an SQL injection attack. This involves exploiting a security gap in the way SQL queries are constructed and  
Figure 5: SQL code for selecting all records from the user table of the database. handled on a website, specifically during the login process. The hacker will aim to delete the organization's user database and needs to ascertain the table name targeted for deletion. To achieve this, the attacker will seek vulnerabilities and, in this instance, exploitation occurs through the URL of the website. Assuming the URL is [[http://www.domain.com/page.php?id=1&id2=1&id3=1](http://www.domain.com/page.php?id=1&id2=1&id3=1)]([http://www.domain.com/page.php?id=1&id2=1&id3=1](http://www.domain.com/page.php?id=1&id2=1&id3=1)) and the database produces an error when a single quote (') is appended to id3, the manipulated URL becomes [[http://www.domain.com/page.php?id=1&id2=1&id3=1](http://www.domain.com/page.php?id=1&id2=1&id3=1)]([http://www.domain.com/page.php?id=1&id2=1&id3=1](http://www.domain.com/page.php?id=1&id2=1&id3=1))'. This process admits other variants than a single quote and involves iterative testing. After encountering an SQL 1064 error resembling \"You have an error in your SQL syntax; check the manual that corresponds to your SQL server version for the right syntax\", the hacker can infer a potential SQL injection vulnerability. The error message is essentially revealing to the attacker that the input provided interfered with the SQL query's structure, hinting at a potential breach for unauthorized access or manipulation of the database. To be successful, the hacker must determine the number of columns used by the web page in the next step. To this end, the hacker engages in testing the column count, using the \"order by\" clause. For instance, the hacker manipulates the URL as [[http://www.domain.com/page.php?id=1&id2=1&id3=1](http://www.domain.com/page.php?id=1&id2=1&id3=1)]([http://www.domain.com/page.php?id=1&id2=1&id3=1](http://www.domain.com/page.php?id=1&id2=1&id3=1))' order by 3 \(\rightarrow+\), where there is no error encountered. The segment'order by 3 \(\rightarrow\) is an attempt to manipulate the SQL query executed by the backend script page.php, where the'character marks the end of a parameter value and by 3 seeks to sort the query results by the third column. The \(\rightarrow\) symbol initiates an SQL comment, ensuring that anything following it is disregarded by the database engine. The \(+\) symbol at the end is an effort to evade potential input filters that could be in place. Subsequent attempts, such as [[http://www.domain.com/page.php?id=1&id2=1&id3=1](http://www.domain.com/page.php?id=1&id2=1&id3=1)]([http://www.domain.com/page.php?id=1&id2=1&id3=1](http://www.domain.com/page.php?id=1&id2=1&id3=1))' order by 10 \(\rightarrow\), will result in an error, specifically \"The query did not execute: Unknown column '10' in 'order clause'''. This iterative process allows the hacker to understand the structure of the table and to determine the exact number of columns used by the web page, enabling the attacker to proceed with more targeted and effective SQL injection attempts. Later, the \"union select\" command will essentially grant the hacker the ability to execute statements directly in the database, with the results reflected on the webpage. Following the example, the hacker will manipulate the URL to [[http://www.domain.com/page.php?id=1&id2=1&id3=1](http://www.domain.com/page.php?id=1&id2=1&id3=1)]([http://www.domain.com/page.php?id=1&id2=1&id3=1](http://www.domain.com/page.php?id=1&id2=1&id3=1))' union select 1,2,3,4,5,6,7,8,9,10. What this accomplishes is the presentation of column numbers to the hacker, indicating which columns are vulnerable for SQL injection. This step is crucial and requires attention to discern the changes. In some cases, alterations are quite noticeable and abrupt, while they are more subtle in others.