I'm in the process of trying to learn more about ethical hacking, however a lot of the sources I am reading about have a lot of text/theory with very little hands on work. I was wondering if anyone could point me in the direction of place where I could learn more about the practical side of things like XSS / SQL injection / etc.
Are there any definitive sources of learning about this sort of thing?
OWASP has several great resources to learn about xss, sql injection, etc.
I suggest you check out their WebGoat project and the Testing Project. These are both great resources to get you started and are free.
WebGoat is a deliberately insecure J2EE web application maintained by OWASP designed to teach web application security lessons. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application.
There are currently over 30 lessons, including those dealing with the following issues: Cross-site Scripting (XSS), Access Control, Thread Safety, Hidden Form Field Manipulation, Parameter Manipulation, Weak Session Cookies, Blind SQL Injection , Numeric SQL Injection, String SQL Injection, Web Services, Fail Open Authentication, Dangers of HTML Comments, ... and many more! https://www.owasp.org/index.php/OWASP_WebGoat_Project
The OWASP Testing Guide includes a "best practice" penetration testing framework which users can implement in their own organizations and a "low level" penetration testing guide that describes techniques for testing most common web application and web service security issues. https://www.owasp.org/index.php/Category:OWASP_Testing_Project
Have some cheese!
Google has a great resource just for this purpose. Gruyere is a website they have created to help developers (and testers) with security flaws. The app is full of security holes and google has written challenges setup for you to break the site. It's really wonderful. Each challenge is labeled with a style (black box, white box, somewhere inbetween), the code is available to run locally, it offers hints and resolutions. So hopefully its just what your looking for!
If you want to learn hacking/cracking/black hat stuff, Google is your friend, but if you want specific information about the topic there are security training programs:
https://www.eccouncil.org/certification/certified_ethical_hacker.aspx
There appear to be many programs, each selling its own manual.
If that's too much and your interest is less formal, you could check out the series entitle "Stealing the Network: How to Own the _". There are many of them on Amazon. They are a little lighter reading and entertaining, but they may be a bit out of date.
The SANS org has some good security courses. http://www.sans.org/security-training/courses.php
http://www.hackthissite.org/pages/index/index.php
as well as the OWASP & Google sites mentioned above
I can get you started on the SQL injection side. Most SQL injection involves the semi-colon (;). The injection attack cleverly ends the current SQL statement, using the semi-colon, and starts one with your injection statement. Some systems safe guard against this method by filtering your input, but there is probably a way to fool the filter.
On an ethical standpoint, I can't think of a way to ethically do SQL injection since it involves performing an operation on a large data-set, which can be damaging.
I know there are some hits, through Google, that give examples to SQL injection; due to researching the methods while designing a security system.
If you have time on Septemer 21 there is a Weeknight testing dedicated to security testing
http://www.softwaretestingclub.com/events/weeknight-testing-black-box-security
