Scribd Logo
Upload

Welcome to Scribd!

  • 16 views

    005 Lab-Blind-SQLi-WebAppSecurity

    Uploaded by

    shark fm
    This document discusses blind SQL injection techniques, including time-based and boolean-based methods. It provides examples of exploiting vulnerabilities using these techniques, such as inferring database details by analyzing response times or return values. The document also includes exercises for the reader to practice these blind SQL injection methods.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    005 Lab-Blind-SQLi-WebAppSecurity

    Uploaded by

    shark fm
    16 views5 pages
    This document discusses blind SQL injection techniques, including time-based and boolean-based methods. It provides examples of exploiting vulnerabilities using these techniques, such as inferring database details by analyzing response times or return values. The document also includes exercises for the reader to practice these blind SQL injection methods.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses blind SQL injection techniques, including time-based and boolean-based methods. It provides examples of exploiting vulnerabilities using these techniques, such as inferring database details by analyzing response times or return values. The document also includes exercises for the reader to practice these blind SQL injection methods.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    16 views5 pages

    005 Lab-Blind-SQLi-WebAppSecurity

    Uploaded by

    shark fm
    This document discusses blind SQL injection techniques, including time-based and boolean-based methods. It provides examples of exploiting vulnerabilities using these techniques, such as inferring database details by analyzing response times or return values. The document also includes exercises for the reader to practice these blind SQL injection methods.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 5

    Lab: Blind SQL Injection

    Purpose
    In this lab, we are going to demonstrate how a Blind SQL injection is executed on a vulnerable
    website and you will also be required to carry out some exercises. In contrast to SQL injection, for
    Blind SQL Injection, the attacker does not get to see the results of the SQL query on the webpage, so
    he is forced to use inference techniques:
    1) Time-Based Blind SQL Injection
    2) Boolean-Based (Truth-Based) Blind SQL Injection

    Time-Based Blind SQL Injection


    In Time-Based Blind SQL Injection attacks, the attacker uses the delay in the response from the
    database server as the basis of his inference of information. For instance, we can use conditional
    sleep statements to differentiate between the different types of responses received.

    1. Open the browser and open the URL: localhost/sqli-union and select Song ID ‘1’

    2. Modify the URL as follows:


    localhost/sqli-union/sql-union.php?id=1’ AND if(‘1’=’1’, SLEEP(10), SLEEP(1)) AND ‘1’=’1
    What this statement means is that if the first condition is true i.e. if ‘1’=’1’ then sleep for 10 seconds
    before returning the response, sleep for 1 second otherwise. Since ‘1’=’1’ is always true, therefore
    we observe a delay of 10 seconds.
    Moving dot illustrates the delay in obtaining results

    Boolean-Based Blind SQL Injection


    1. We will now try to infer the first character of the database name using the following command:
    localhost/sqli-union/sql-union.php?id=1’ AND Ascii(substring(database(),1,1))=’67

    The Ascii function gets a character and returns the Ascii value of that character. In this case, the
    Ascii function has a call to the database function as an argument. The database function returns the
    name of the database, but since we have specified parameters (1,1) then this would return just the
    first character of the database name. Thus, the substring would get the first character of the database
    name and the Ascii function would convert this character to its corresponding value, and compare it
    to Ascii equivalent of 67 which is ‘C’. Please refer to the Ascii table below:

    Character Ascii Character Ascii Character Ascii Character Ascii


    A 65 N 78 a 97 n 110
    B 66 O 79 b 98 o 111
    C 67 P 80 c 99 p 112
    D 68 Q 81 d 100 q 113
    E 69 R 82 e 101 r 114
    F 70 S 83 f 102 s 115
    G 71 T 84 g 103 t 116
    H 72 U 85 h 104 u 117
    I 73 V 86 i 105 v 118
    J 74 W 87 j 106 w 119
    K 75 X 88 k 107 x 120
    L 76 Y 89 l 108 y 121
    M 77 Z 90 m 109 z 122
    Since we received an invalid song ID message, therefore we can conclude that the first character of
    the database name is not ‘C’.

    2. Our database is actually named “Information”, so let’s try for the first character to be ‘I’
    (Ascii=73):
    localhost/sqli-union/sql-union.php?id=1’ AND Ascii(substring(database(),1,1))=’73
    Since the query executed successfully, and even though we don’t get to see the database name on
    screen, but we can infer that the first character of the database name is ‘I’. Thus, this process can be
    continued through the use of automated scripts to enumerate the database name.

    Task:
    We have purposefully left out the implementation of the time-based blind SQL injection query to test
    the first character of our database and we only checked if ‘1’=’1’. See if you can craft a query which
    allows you to use time-based inference to check if the first character of the database name is ‘I’.

    (Solution on Next Page)


    Solution:
    We need an if statement along with the Ascii function as follows:

    localhost/sqli-union/sql-union.php?id=1’ AND if(Ascii(substring(database(),1,1))=’73’,


    SLEEP(10), SLEEP(1)) AND ‘1’=’1

    Moving dot illustrates the delay in obtaining results

    You might also like