Question

You have performed a SQL injection attack against a website using Burp Suite and see the following results.

What are you looking for? Any results that have a large length


Any results that show the server returning an error


Any results that show the username and password of any users on the system


Any results that show something unexpected being passed back from the server

Answer 1

All of the items you listed are valid indicators that your injection attempts had an effect — but some are stronger signals than others. Briefly:

- Any results with a large length
- A sudden increase in response size can indicate the server returned additional data (e.g., via a UNION or changed query result). It’s a useful sign but can be a false positive if the page simply renders differently.

- Any results that show the server returning an error
- SQL error messages from the database are a strong indicator that your input affected the query. They can also leak useful schema information (table/column names), so beware of exposing sensitive info.

- Any results that show the username and password of any users on the system
- That is direct evidence of data exposure and the most serious finding. If you see credentials or other sensitive data, treat it as a critical vulnerability.

- Any results that show something unexpected being passed back from the server
- Unexpected output (different fields, HTML fragments, stack traces, IDs, etc.) often signals that the back-end logic or data returned changed because of your input.

Practical notes (non-exploitative):
- Correlate multiple indicators (errors + changed length + unexpected fields) before concluding you have a vuln to avoid false positives.
- If you are testing, ensure you have explicit authorization and follow a responsible disclosure process.
- For remediation guidance: recommend parameterized queries/prepared statements, strict input validation, least-privilege DB accounts, and sensible error handling to avoid revealing DB internals.

If you want, tell me what specific responses you saw (error text, length differences, or returned content) and I can help you interpret them at a high level.