Using Burp to Detect SQL Injection Via SQL-Specific Parameter Manipulation - Port Swigger
Summary: PortSwigger's walkthrough shows how to detect subtle SQL injection by manipulating a URL parameter in Burp Repeater and watching how the response changes. In the examples, changing the 'id' value returns another user's details, entering 3-2 returns user 1, and the expression 50-ASCII(1) returns user 1 without errors, showing the input is evaluated as a SQL query; a second example changes user-info.php to user'%20'-info.php, where the space concatenates strings in some SQL databases.
Bottom line: The technique needs no error message to succeed: a parameter that quietly evaluates arithmetic and SQL functions like ASCII is enough to confirm injection, so a page that looks normal can still be handing back other users' records.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026