SQL Injection

Recursos cross-platform para SQL Injection: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

Esta página agrega los recursos para practicar SQL Injection de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

Cobertura: 78 retos en 3 plataformas — 36 HackTheBox · 22 PortSwigger · 20 TryHackMe. 36 con writeup en español, 36 con writeup en vídeo.

​

Por dónde empezar

Ordenado por dificultad real. A igual nivel, primero el lab aislado, después la room guiada y por último la máquina completa.

1. PortSwigger — Detecting NoSQL injection (Apprentice) · 🇬🇧
2. PortSwigger — Exploiting NoSQL operator injection to bypass authentication (Apprentice) · 🇬🇧
3. PortSwigger — SQL injection vulnerability allowing login bypass (Apprentice) · 🇬🇧
4. PortSwigger — SQL injection vulnerability in WHERE clause allowing retrieval of hidden data (Apprentice) · 🇬🇧
5. TryHackMe — 25 Days of Cyber Security (Easy · ~45 min) · 🇬🇧
6. TryHackMe — Advent of Cyber 2 [2020] (Easy · ~45 min) · 🇬🇧

​

Recursos curados

Fuente	Enlace
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/sql-injection/index.html
PortSwigger	https://portswigger.net/web-security/sql-injection

​

Máquinas HTB que practican SQL Injection (36)

Máquina	SO	Dificultad	Writeup
Altered	Linux	HARD	🇪🇸 🇬🇧 📹
Bankrobber	Windows	INSANE	🇪🇸 🇬🇧 📹
Bastard	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Breadcrumbs	Windows	HARD	🇪🇸 🇬🇧 📹
Cache	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Cascade	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Catch	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Charon	Linux	HARD	🇪🇸 🇬🇧 📹
Control	Windows	HARD	🇪🇸 🇬🇧 📹
Cronos	Linux	MEDIUM	🇪🇸 🇬🇧 📹
EarlyAccess	Linux	HARD	🇪🇸 🇬🇧 📹
Enterprise	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Europa	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Falafel	Linux	HARD	🇪🇸 🇬🇧 📹
Fighter	Windows	INSANE	🇪🇸 🇬🇧 📹
Flujab	Linux	HARD	🇪🇸 🇬🇧 📹
Giddy	Windows	MEDIUM	🇪🇸 🇬🇧 📹
GoodGames	Linux	EASY	🇪🇸 🇬🇧 📹
Holiday	Linux	HARD	🇪🇸 🇬🇧 📹
Mango	Linux	MEDIUM	🇪🇸 🇬🇧 📹
MultiMaster	Windows	INSANE	🇪🇸 🇬🇧 📹
Nightmare	Linux	INSANE	🇪🇸 🇬🇧 📹
NodeBlog	Linux	EASY	🇪🇸 🇬🇧 📹
Overflow	Linux	HARD	🇪🇸 🇬🇧 📹
OverGraph	Linux	HARD	🇪🇸 🇬🇧 📹
Oz	Linux	HARD	🇪🇸 🇬🇧 📹
Pandora	Linux	EASY	🇪🇸 🇬🇧 📹
Phoenix	Linux	HARD	🇪🇸 🇬🇧 📹
Scavenger	Linux	HARD	🇪🇸 🇬🇧 📹
SecNotes	Windows	MEDIUM	🇪🇸 🇬🇧 📹
StreamIO	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Toolbox	Windows	EASY	🇪🇸 🇬🇧 📹
Union	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Validation	Linux	EASY	🇪🇸 🇬🇧 📹
Writer	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Zetta	Linux	HARD	🇪🇸 🇬🇧 📹

​

Labs PortSwigger que practican SQL Injection (22)

Lab	Dificultad	Topic	Oficial
Detecting NoSQL injection	APPRENTICE	NoSQL Injection	Abrir
Exploiting NoSQL operator injection to bypass authentication	APPRENTICE	NoSQL Injection	Abrir
SQL injection vulnerability allowing login bypass	APPRENTICE	SQL Injection	Abrir
SQL injection vulnerability in WHERE clause allowing retrieval of hidden data	APPRENTICE	SQL Injection	Abrir
Blind SQL injection with conditional errors	PRACTITIONER	SQL Injection	Abrir
Blind SQL injection with conditional responses	PRACTITIONER	SQL Injection	Abrir
Blind SQL injection with out-of-band data exfiltration	PRACTITIONER	SQL Injection	Abrir
Blind SQL injection with out-of-band interaction	PRACTITIONER	SQL Injection	Abrir
Blind SQL injection with time delays	PRACTITIONER	SQL Injection	Abrir
Blind SQL injection with time delays and information retrieval	PRACTITIONER	SQL Injection	Abrir
Exploiting NoSQL injection to extract data	PRACTITIONER	NoSQL Injection	Abrir
Exploiting NoSQL operator injection to extract unknown fields	PRACTITIONER	NoSQL Injection	Abrir
SQL injection attack, listing the database contents on non-Oracle databases	PRACTITIONER	SQL Injection	Abrir
SQL injection attack, listing the database contents on Oracle	PRACTITIONER	SQL Injection	Abrir
SQL injection attack, querying the database type and version on MySQL and Microsoft	PRACTITIONER	SQL Injection	Abrir
SQL injection attack, querying the database type and version on Oracle	PRACTITIONER	SQL Injection	Abrir
SQL injection UNION attack, determining the number of columns returned by the query	PRACTITIONER	SQL Injection	Abrir
SQL injection UNION attack, finding a column containing text	PRACTITIONER	SQL Injection	Abrir
SQL injection UNION attack, retrieving data from other tables	PRACTITIONER	SQL Injection	Abrir
SQL injection UNION attack, retrieving multiple values in a single column	PRACTITIONER	SQL Injection	Abrir
SQL injection with filter bypass via XML encoding	PRACTITIONER	SQL Injection	Abrir
Visible error-based SQL injection	PRACTITIONER	SQL Injection	Abrir

​

Rooms TryHackMe que practican SQL Injection (20)

Room	Dificultad	Tipo	Acceso	Oficial
25 Days of Cyber Security	EASY	Walkthrough	🟢 Free	Abrir
Advent of Cyber 2 [2020]	EASY	Walkthrough	🟢 Free	Abrir
Advent of Cyber 2022	EASY	Walkthrough	🟢 Free	Abrir
Advent of Cyber 3 (2021)	EASY	Walkthrough	🟢 Free	Abrir
Avengers Blog	EASY	Walkthrough	🔵 VIP	Abrir
Custom Tooling Using Python	EASY	Walkthrough	🟢 Free	Abrir
NoSQL Injection	EASY	Walkthrough	🟢 Free	Abrir
OWASP Juice Shop	EASY	Walkthrough	🟢 Free	Abrir
Simple CTF	EASY	Challenge	🟢 Free	Abrir
SQLMap: The Basics	EASY	Walkthrough	🔵 VIP	Abrir
WAF: Introduction	EASY	Walkthrough	🟢 Free	Abrir
Advanced SQL Injection	MEDIUM	Walkthrough	🟢 Free	Abrir
CTF collection Vol.2	MEDIUM	Challenge	🟢 Free	Abrir
Prioritise	MEDIUM	Challenge	🟢 Free	Abrir
SQHell	MEDIUM	Challenge	🟢 Free	Abrir
SQL Injection	MEDIUM	Walkthrough	🟢 Free	Abrir
TryHack3M: Sch3Ma D3Mon	MEDIUM	Walkthrough	🟢 Free	Abrir
Wekor	MEDIUM	Challenge	🟢 Free	Abrir
Daily Bugle	HARD	Challenge	🔵 VIP	Abrir
Sequel Dump	HARD	Challenge	🔵 VIP	Abrir

​

Skills relacionadas

• /skills/rce
• /skills/xss

---

← Volver al glosario completo

Última actualización: 2026-08-17