performing-second-order-sql-injection

Second-order SQL injection testing requires identifying a storage point (like user registration) and a separate trigger point (like an admin panel) that uses the stored data in an unsafe query. Inject the payload at the storage point, then invoke the trigger function and observe the response for injection effects.

Use SQLMap with the --second-url flag to specify the trigger endpoint, or --second-req with a saved request file for complex triggers. Mark the injectable parameter with an asterisk in the --data payload of the storage request.

First-order injection executes the payload immediately at the input point, while second-order injection stores the payload safely and executes it later in a different operation. Second-order attacks bypass input-time sanitization because developers trust data retrieved from the database.

Yes, boolean-based, time-based (WAITFOR DELAY), and out-of-band DNS extraction all work for second-order injection. Store the blind payload, trigger execution, and observe response differences, timing delays, or collaborator interactions.

The agent requires a JSON database dump mapping table names to row objects, plus a source code directory to scan for dangerous query patterns. Run it with --db-dump and --source flags to correlate stored payloads with code sinks into confirmed attack paths.