By SQL injection from sites, I take it: (a) you have some web forms, (b) there's a SQL back-end, (c) you use methods which prevent user input from being mis-interpreted as SQL (parameterized queries, etc.)
But still you would like to detect attempts at SQL injection. Ok.
One of the standard ways to attempt SQL injection is to probe around seeking an input field which is incorporated to a SQL query by using string insertion. For example:
snprintf(buf, dimensionof(buf), "SELECT calory_limit FROM user_diets WHERE user_firstname='%s' AND user_surname='%s'", firstname, surname);
Where surname and firstname are unfiltered inputs from a web form. In this example, a user could provide the name firstname=
The sprintf would result in:
SELECT calory_limit FROM user_diets WHERE user_firstname='Johnny'' AND user_surname=''-';DROP DATABASE;--'
Because '' (two single quotes) in SQL is interpreted as an escaped ' which is part of the string, we have "broken open" the string delimiter in the intended original statement. This lets us convert what later should have been string, surname, into commmand.
In short, look for people entering fields which:
- End in a single quote mark
- Begin with a single quote mark
- Contain a "--" at or near the end (The purpose of wrapping the attack payloads up with a SQL comment delimiter is that without that, the attacker's distortion of the intended query could leave some unparsable command bits at the end. These could generate an error message to a log and alert you.)
Also, you might consider the same heuristics after, e.g., UTF-8 decoding the input. Or UTF-8 decoding it twice over. The penetration tester will be thinking about bugs that might be in your code, so they will try inputs which seem not to make sense -- such as twice-UTF-8-encoded single quote marks.
Also, look for
" and other HTML entity sequences.
You can search arxiv.org and find some papers which detail certain specific attack flavors: cross-site scripting, SQL injection, URL modification. Reading some papers there will lead you to more.