In this Article We have talked about Blind SQL Injection
What is Blind SQL Injection?
When a web application is vulnerable to SQL injection but its HTTP answers don’t include the results of the SQL query or any information about database issues, this is known as blind SQL injections (blind SQLi).
This is different from a typical SQL injection, where the attacker may see the web application’s display of the fraudulent SQL query’s output or database error.
The results of the SQL queries are never visible to the attackers in a Blind SQL Injection. However, they might check to see if the website or application loads normally and estimate how long the SQL server will take to process the SQL query that an attacker entered using user input.
When a malicious query is successfully run by an attacker, they gain control of the database server. Data theft (such as credit card numbers) results from this, and privilege escalation may make it possible to completely take control of the web server operating system.
Content-Based Blind SQL Injection Attacks
An attacker uses numerous SQL queries to claim the database returns TRUE or FALSE results in this kind of blind SQL injection.
The attacker then notices variations between statements that are TRUE and FALSE. Below is a blind SQL injection example using an online webshop, which displays items for sale.
The following link displays details about the item with ID 14, that is retrieved from a database.http://www.webshop.local/item.php?id=14
🔰 The SQL query used to get this request is:
• SELECT columnName, columnName2 FROM table_name WHERE id = 14
🔰 The attacker inserts the following blind SQL injection payload:
•http://www.webshop.local/item.php?id=14 and 1=2
🔰 Now, the SQL query looks like:
• SELECT columnName2 FROM tableName WHERE ID = 14 and 1=2SELECT name, description, price FROM StoreTable WHERE ID = 14 and 1=2
🔰This results in the query returning FALSE with no items displayed in the list. The attacker then proceeds to modify the request to:
• http://www.webshop.local/item.php?id=14 and 1=1
🔰Now, the SQL query looks like:
• SELECT columnName, columnName2 FROM tableName WHERE ID = 14 and 1=1SELECT
The database will return TRUE, and the details of the item with ID 14 are displayed. This is an indication that this webpage is vulnerable.
✨ This is how you find your first blind (Content-Based) SQLi, our next article will dig into how you can find Time-Based Blind SQLi.
Remember that there are numerous automated tools in the market for finding SQLi but it is always advisable to learn how to manually find these vulnerabilities.
Some Blind SQL Injection Resources
LAB : https://portswigger.net/web-security/sql-injection/blind
Video : https://youtu.be/joZKlgR1J5A