SQL injection attacks can be classified into two primary types: In-band SQL Injection and Blind SQL Injection. In-band SQL Injection is the most straightforward type, where the attacker directly extracts data from the database using the same channel they infiltrated. This type is typically further divided into two subcategories: Error-based SQL Injection and Union-based SQL Injection. In Error-based SQL Injection, the attacker deliberately generates errors in the SQL query, leveraging the error messages returned by the database to gain insights into its structure. In Union-based SQL Injection, an attacker uses the UNION SQL operator to combine the results of two or more SELECT statements, allowing them to retrieve data from different tables seamlessly.

The second category, Blind SQL Injection, is utilized when an attacker cannot see the output of a SQL query, often due to the application’s failure to show error responses. This method relies on the application’s behavior rather than direct feedback. Blind SQL Injection can be further categorized into Boolean-based and TIME-based techniques. In Boolean-based Blind SQL Injection, the attacker crafts queries that return true or false responses to gain insights about the database indirectly. TIME-based Blind SQL Injection, on the other hand, involves introducing delays into the SQL query execution to infer structural and content-related information based on the response time of the server, making it a more stealthy method of extraction.