How to make a site vulnerable to SQLi?

Question

I've recently taken an interest in SQL injections - it (for some reason, correct me if I'm wrong) seemed like a good place to start (I am pretty much a beginner). Anyways, I want to make a site that I can practice on. In other words, basically maybe one content page, a login page, and a database with say admin, users, passes, so on and so forth.

I will have to learn SQL, but that will take me half an hour, I've already skimmed over a few sites. I will probably need HTML, and some basic PHP...?

My question: am I missing anything? And what exactly defines vulnerable SQL code? Sorry, I being a bit broad here. The closest I found is this: http://forum.codecall.net/topic/39264-make-a-script-vulnerable-to-sql-injection/

On a side note, is SQLi a good place to start with web vulnerabilities?

Thanks in advance!

EDIT: thanks for all the wonderful answers!

Answer 1

Don't bother writing your own site for a practice like that. Instead, make use of the plentiful resources on the web.

A good practice target is the Damn Vulnerable Web Application(DVWA) project. The OWASP WebGoat project is another nice one.

Answer 2

A few notes

An SQL injection attack is when something unexpected is inserted into a database. The types of injections depend on the vulnerabilities of the system.

SQL Query Injection

If the database doesn't have proper permissions, meaning that the web user has full control over the database, then they can potentially do things like replace all records, drop tables, and add their own tables.

An example might be an injection on an edit where site is expecting the user to edit their own record, but instead they update all in the server.

\' or where 1=1;

If they have read-only access to the database they might escalate their privileges and pull out more info than they're supposed to. This example would be on a server that is returning two records, the user then adds the user's table as their result.

\' UNION ALL SELECT username,password from USERS;

PHP injection

Many of the features of the latest versions of PHP have been hardened to fix issues with code execution however some developers use things like exec() to perform actions on code pulled from a database. Some older versions of PHP are still vulnerable to attack.

Developers are the front line for defense when it comes to writing a website. Let's say you have a corporate CMS and the developers created a user-editable table in the CMS for modifying something like display ads.

The attacker could enter phpinfo(); and see all of the database about the server, or execute command line codes (depending on the access of the website user account on the web server), or add their own backdoor to the site (write or rewrite files). This could allow the user to redirect all traffic off of the site entirely.

Script injection

While the site's PHP may be less vulnerable to an attack, a user may still inject things such as iframes containing malicious code, javascripts containing malicious code, or JAVA applets that allow them to steal user cookies. Since javascript can execute AJAX and send requests to a different webserver unannounced this would likely not be seen in the interface even though it could happen.

<script type='text/javascript'> 
  window.location('http://someotherwebsite.com');
</script>

Testing

The legal ramifications for testing on someone else's box are different depending on the country you're in and the country the server is being hosted in. With that being said, there are a lot of free versions of operating systems like FreeBSD and various types of Linux (some more secure than others) where you can install an OS, a web server, and a MySQL server on a Virtual Machine under something like Virtual Box and go to town without hosing your production machine.

Some of the other answers given by other posters are excellent in this thread as well.

Answer 3

If you like to get into webvulnerabilities, i recommend you to learn some basics about PHP, HMTL, Javascript and SQL.

If you have done this: Getting started with OWASP

Answer 4

Any form that takes input and uses it directly in a SQL query without checking to make sure the input is safe would be vulnerable to SQL injection. Being vulnerable to SQL injection is more or less the standard state of being unless you specifically take measures to protect against it in your code.

Answer 5

To add to Terry Chia's resources, there's an SQL injection tutorial from PentesterLab which does pretty much what you're after, called From SQLi to Shell. I did it yesterday, it's very good. They offer a couple more advanced walk-throughs too.