Post cover image

August 25, 2026

The SQL Injection Money Ladder: From First Payload to $25,000

A hands-on run up the techniques that actually pay. Every rung is a free, legal lab you run yourself — and every rung ends at a real report…

By Raj Namdev

4 min read

A hands-on run up the techniques that actually pay. Every rung is a free, legal lab you run yourself — and every rung ends at a real report that cashed.

⏱ 30-second version

SQL injection isn't dead — HackerOne paid out on 1,213 SQLi bugs in 2025, averaging ~$1,074 each. The gap between a $1,074 report and a $25,000 one is a five-rung skill ladder, and you can climb all of it tonight, for free, on PortSwigger Academy labs:

  1. WHERE clause bypass (' OR 1=1--) — table stakes, ~$1,074 avg.
  2. UNION-based extraction — pull other tables, credentials included — $2,000.
  3. Blind SQLi (conditional response) — yes/no via page behavior — up to $5,000.
  4. Time-based blind SQLi (pg_sleep) — the clock as your output channel — up to $15,000.
  5. Filter/context bypass (XML encoding, array params) — the top of the ladder — $25,000 (Valve, CVSS 9.9).

Bonus lesson: technique doesn't matter if the program doesn't pay — the single highest-upvoted SQLi report in the dataset (Starbucks, CVSS 9.3, 797 upvotes) paid $0.

Read on for the labs, the exact payloads, and the checkpoints.

Rung 1 — The twenty-minute pop

Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data (Apprentice)

The lab has a product category filter — a dropdown whose value lands inside a SQL WHERE clause. Intercept the request in Burp, find the parameter, and break the logic:

category=Gifts' OR 1=1--

The quote closes the string. OR 1=1 is always true. The -- comments out everything after it, including the filter.

Checkpoint: the response now returns every product — including the ones the filter was hiding. You just changed what the database told the application. That's rung one, and it's the whole foundation: input the app trusts, logic you rewrote.

What it's worth in the wild: this is table stakes — confirmation-level findings. That ~$1,074 average is mostly this floor: real bugs, basic proof. The ladder above it is where the multiples live.

Rung 2 — Stealing the table

Labs: Determining the number of columns, then retrieving data from other tables (Practitioner)

Reading hidden rows is nice. Reading other tables is the rung where SQL injection starts printing credentials. The vehicle is UNION SELECT — but the original query returns a fixed number of columns, so you count them first with NULLs:

category=Gifts' UNION SELECT NULL--
category=Gifts' UNION SELECT NULL,NULL--
category=Gifts' UNION SELECT NULL,NULL,NULL--

The payload that stops erroring is your column count. Then find a string-typed column, swap in a real query, and pull from a table that was never meant to be in the response — in the lab, users, with usernames and passwords.

Checkpoint: the product page now renders someone's credentials where a product description used to be.

What it paid in the wild: $2,000 on Eternal's program for a SQLi on hyperpure.com, and the disclosed dataset shows Razer paying $2,000 apiece for three separate SQLi findings in the same period. Extraction beats confirmation. Every time.

Rung 3 — Blind: asking yes/no questions

Lab: Blind SQL injection with conditional responses (Practitioner)

Now the hard mode that separates hunters from scanners: the page shows no data, no errors — nothing reflects your injection. So you stop asking for data and start asking questions the page behavior can answer. The lab tracks you with a cookie; you make the "welcome back" message conditional:

TrackingId=x'||(SELECT CASE WHEN (SUBSTRING((SELECT ...),1,1)='a') THEN '' ELSE 1/0 END)--

Wrong character → error → no welcome message. Right character → the message appears. One bit per request, and you extract a password one character at a time.

Checkpoint: the welcome-back message flickers on and off as your condition flips. That's a database answering yes/no through a page that never showed you anything.

What it paid in the wild: a blind SQLi via the User-Agent header on a U.S. General Services Administration site — Critical, CVSS 9.1 — where the researcher explicitly noted they confirmed the injection without extracting data. Confirmation discipline, in an input nobody types into. The dataset's blind entries on Mail.ru programs ran up to $5,000.

Rung 4 — Time: when the page won't talk at all

Labs: Blind SQL injection with time delays, then time delays and information retrieval (Practitioner)

No conditional output anywhere? Make the clock the output. A payload that sleeps when your condition is true turns response latency into your one-bit channel:

TrackingId=x'||(SELECT CASE WHEN (1=1) THEN pg_sleep(10) ELSE pg_sleep(0) END)--

Checkpoint: the response takes ten seconds when the condition is true, returns instantly when it isn't. You've turned a mute application into a working oracle — slower than rung 3, but it works when nothing else does.

What it paid in the wild: time-based is where the disclosed numbers get serious. The dataset's top time-based entry: $15,000 on Mail.ru, with another at $10,000. Patience, monetized.

Rung 5 — Contexts: where the quotes never reach

Lab: SQL injection with filter bypass via XML encoding (Practitioner)

Everything so far went through a query parameter. The top of the ladder is injection points that never appear in a URL: XML bodies, JSON fields, headers, array parameters — inputs your scanner's default checks skip and your habits miss. The lab blocks SQL keywords in an XML field; XML character entities encode your way past the filter.

Checkpoint: the blocked payload, entity-encoded, executes.

What it paid in the wild: the top of the disclosed ladder — $25,000, Critical, CVSS 9.9 on Valve. The report title tells you the whole shape: "SQL Injection in report_xml.php through countryFilter[] parameter." An XML report endpoint, an array-style parameter — two rung-five contexts stacked in one finding.

The $0 lesson at the top of the stairs

One more report before you close the tab. The most-upvoted SQL injection in the disclosed dataset — 797 upvotes, Critical, CVSS 9.3 — extracted Starbucks' enterprise accounting, financial, and payroll databases. Bounty: $0. Nothing about the technique was the problem; the checkbook was closed before the first payload. Program choice is the floor under the entire ladder — climb skill all you want, check who's paying first.

Your scorecard

Seven labs, one evening, zero dollars:

  1. Rung 1 — hidden data released (OR 1=1)
  2. Rung 2 — column count found with NULLs
  3. Rung 2 — credentials read from another table
  4. Rung 3 — one character extracted via conditional response
  5. Rung 4 — a 10-second oracle built from pg_sleep
  6. Rung 5 — a filtered payload through XML encoding
  7. Bonus — login bypass with a comment sequence, if you have ten minutes left

Finish that list and you haven't read about SQL injection — you've done it, in order of escalating value, on targets built to teach exactly this. The disclosed record says where the rungs cash: ~$1,074 on average, $2,000 for extraction, $15,000 for patience, $25,000 at the top.

The first rung takes twenty minutes. It's free. Go pop something.

Sources

  • "1,213 SQL Injection bugs are found on HackerOne in 2025" — r/bugbounty — 2025 volume and average-reward figures.
  • SQL injection course — PortSwigger Web Security Academy — free labs, techniques, and detection methods.
  • Dataset: reddelexc/hackerone-reports — TOPSQLI list; Mail.ru/Razer blind and time-based bounty figures are from this dataset.
  • Directly cited reports (severity and bounty from each report's live JSON): #383127 Valve — Critical 9.9, $25,000 · #531051 Starbucks — Critical 9.3, $0 · #297478 GSA — Critical 9.1 · #1044716 Eternal — $2,000 · #403616 Zomato-property — $4,500.