Lion Cipher Lab
Read SQLmap output: which parameter is vulnerable, what type, and how bad is it?
- Penetration Testing / Red Team
- Intermediate
- ~35 min
- Free · no account required
Why it matters
A scanner that says 'SQL injection found' is the easy part. The job — the part an interviewer, a report reader, and a developer actually care about — is reading the output well enough to answer three questions: which input is broken, how exploitable is it really, and how do we fix it for good. Those answers change with the injection TYPE: a slow time-based blind and a UNION that reads the admin table are both 'SQL injection', but they are worlds apart in severity, and only the output tells you which you're looking at. This lab trains that reading. You will look at real-shaped sqlmap output…
What you'll learn
- reading a sqlmap injection-point block: the parameter, the place (GET/POST/header/cookie), the type, and the payload
- knowing what each injection technique means — boolean-based blind (B), error-based (E), UNION (U), time-based blind (T), stacked queries (S) — and what it implies about exploitability
- reading the DBMS fingerprint and knowing why the version line matters
- assessing impact from the output alone, without launching any further attack
- distinguishing a confirmed injection from a mere heuristic probe
- translating tool output into a developer-ready finding: vulnerable parameter, root cause, and the correct fix
- the discipline: read the evidence, run this only against apps you own or are authorized to test, and hand developers a root-cause fix — not just 'SQLi found'
Steps in this lab
- The scenario, and the one rule that makes it legal
- The output you were handed
- Find the vulnerable input: which parameter, and where it lives
- Read the injection TYPES — and what each one implies
- Read the DBMS fingerprint — and why the version line earns its place
- Assess the impact — from the output alone, no further attack
- Confirmed injection vs a mere probe — don't confuse the two
- Write the developer-ready finding: root cause and the real fix
- The judgment to keep