SQL Injection (Blind)
In the case of blind SQL injection (bSQLi) we don't directly leak information to the browser, directly from the database. In this case, we know that there is a connection to the database, but we do not directly view information from it.
When we enter an identifier, the result is simply an indication that it exists, or not.
Therefore, the previous techniques will no longer work.
For these kinds of bSQLi techniques, we'll turn to a tool called "sqlmap".
To do this we will execute the following command:
As we are talking about a page that is behind an authentication mechanism, we need to pass a cookie that has the PHPSESSID of a session, otherwise we would be redirected to the login page. To get a valid PHPSESSID we can use Burp Suite, to intercept a valid Session ID. As alternative, we can also inspect the web page and discover the PHPSESSID.
After running the command, we can check the output of sqlmap. If all goes well, in the end we can confirm that the "id" parameter is injectable, and that we can identify the databases in the target system.
[*] starting @ 17:36:16 /2022-11-17/
Once we have verified that the database is "injectable", from this point on sqlmap can be used to explore the information it can find.
Let's start by listing the tables of a database: dvwa.
The result is a listing of the database tables.
Check current user:
Which shows:
List all users:
This lists all the users that access the database:
List the corresponding passwords (password hashes that can then be cracked using dictionary or brute force techniques. Even sqlmap is already equipped with these tools):
That produces the following output:
Print the table structure:
That shows the tables.
Finally, dump the contents of the database tables, and if by chance the database contains passwords (hash), attack them and show them in clear:
Displays all the information on the tables:
Last updated