SQL Injection

This page aggregates cross-platform resources to practice SQL Injection: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills. Coverage: 78 challenges across 3 platforms — 36 HackTheBox · 22 PortSwigger · 20 TryHackMe. 36 with a Spanish writeup, 36 with a video writeup.

​

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Detecting NoSQL injection (Apprentice) · 🇬🇧
2. PortSwigger — Exploiting NoSQL operator injection to bypass authentication (Apprentice) · 🇬🇧
3. PortSwigger — SQL injection vulnerability allowing login bypass (Apprentice) · 🇬🇧
4. PortSwigger — SQL injection vulnerability in WHERE clause allowing retrieval of hidden data (Apprentice) · 🇬🇧
5. TryHackMe — 25 Days of Cyber Security (Easy · ~45 min) · 🇬🇧
6. TryHackMe — Advent of Cyber 2 [2020] (Easy · ~45 min) · 🇬🇧

​

Curated resources

​

HTB machines practicing SQL Injection (36)

​

PortSwigger labs practicing SQL Injection (22)

​

TryHackMe rooms practicing SQL Injection (20)

​

Related skills

• /en/skills/rce
• /en/skills/xss

---

← Back to the full glossary Last updated: 2026-08-17