Blind SQL Injections
The SQLi payloads we have encountered are in-band,
meaning we’re able to retrieve the database content of our query
inside the web application.
Alternatively,
blind SQL injections describe scenarios
in which database responses are never returned
and behavior is inferred using either boolean- or time-based logic.
As an example, generic boolean-based blind SQL injections
cause the application to return different and predictable values
whenever the database query returns a TRUE or FALSE result,
hence the “boolean” name.
These values can be reviewed within the application context.
Time-based blind SQL injections infer the query results
by instructing the database to wait for a specified amount of time.
Based on the response time,
the attacker is able to conclude if the statement is TRUE or FALSE.
Our vulnerable application includes a code portion
affected by both types of blind SQL injection vulnerabilities.
Closely reviewing the URL,
we’ll notice that the application takes a user parameter as input,
defaulting to offsec since this is our current logged-in user.
The application then queries the user’s record,
returning the Username, Password Hash, and Description values.
To test for boolean-based SQLi, we can try to append a payload to the URL:
Since 1=1 will always be TRUE,
the application will return the values
only if the user is present in the database.
Using this syntax, we could enumerate the entire database for other usernames
or even extend our SQL query to verify data in other tables.
We can achieve the same result by using a time-based SQLi payload:
In this case, we appended an IF condition
that will always be true inside the statement itself,
but will return false if the user is non-existent.
We know the user offsec is active,
so when we paste the time-based payload in our Kali VM’s browser,
we’ll notice that the application hangs for about three seconds.
This attack angle can clearly become very time consuming,
so it’s often automated with tools like sqlmap,
as we’ll cover in the next Learning Unit.