So previously we covered SQL injections and in today's
class we're gonna talk about blind SQL injections.
Blind SQL injections are very similar to
classic SQL injections that we covered previously.
So they basically allow an attacker to exploit the web application and run SQL
queries and then the SQL queries will actually be executed by the database engine.
So for example,
if you run a select statement to select the passwords from the user's database,
the web application will send it to the engine to
the database engine and the database engine will execute it.
The only problem is with blind SQL injections is that you will not see the
result being displayed on screen because the result
is not returned to the web application.
That is the only difference between blind and normal scale injections.
So let me show you a quick example.
Previously we had this example right here and I
already put the payload because we covered it before.
We're selecting the user name and you can see on screen the user name and
the password being returned in here and we have the admin and its password.
So that's an example of a normal SQL injection
in a blind SQL injection.
The query that we executed in here will actually be executed on the target.
So this query right here would be executed on
the target and will be executed by the database engine
but we will not see the result on screen.
Therefore exploiting it is a little bit trickier.
And that's what we're going to focus on in this class
as usual you'd want to go ahead and test everything like every button.
I know I always say this but it's very important to understand it because
in these classes now it seems like I already know where the vulnerability is.
Like I have a superpower but I don't obviously we covered how you approach
a pen test or bug hunt and now we're just focusing on individual vulnerabilities.
So I'm gonna turn on my interceptor and I'm just gonna load any page.
First of all you want to take a look at the page the way it is.
So just have a normal look at the page again,
you have a number of parameters in here that
you should test test everything as we explained before.
But I'm gonna turn on my interceptor
and we're just going to reload this page.
And as you can see we have the query parameter in here so you have the product I. D.
Which is a parameter that you should test for all of the non vulnerabilities.
And if we look under the request cookies in here, we have two cookies being sent.
So this is the first time that we exploit something through the cookies.
We have the name here, tracking I. D. And we have the value right here.
So similar to what we usually do, we go ahead and test all possible vulnerabilities.
And because we're covering SQL injections in
here we're gonna test for SQL injections
and as covered in the previous class to test for SQL injections.
We usually run a false and a true statement.
A false statement would look something like this.
So we would close the original statement and then we would say for example
and two is equal to one and we close it with a comment.
And like I said there's different type of
types of comments that you should test with.
You could look at them in the
cheat or with the experience you will know the different types
and then to run a true statement you could simply run the exact
same statement but this time instead of two is equal to one.
We're gonna say two is equal to two which
is true which should return a true statement.
So let's go ahead and run a false statement and again going back
you need to take a good look at the page on what it looks
like and make sure you noticed all the changes or all the things that
could change within the page because we're about to run a false statement.
Therefore the page should break or change in some way.
So let's go ahead and run the false statement.
I'm just gonna paste it after the current value for the tracking I. D.
So I have my comment here that closes the existing statement
in the back end in the web application and then I'm injecting
and two is equal to one which is false and then
I'm adding a comment to ignore everything that comes after that.
Anything that the web application adds to this query will be ignored as a comment.
I'm going through this very quickly because we covered
all that in details in the previous lecture.
So if this seems a little bit hard to understand,
then please revise the previous lecture,
I'm gonna hit enter and I'm gonna forward this request,
something did change and here I had something saying welcome back
And now it disappeared because I actually run a false statement.
Now let's go ahead and run it again. This time we're going to run the true statement.
So this is false. Two is equal to one is false. Now let's run a true statement.
Two is equal to two and note how in here
we're gonna have a string that says welcome back.
So I'm going to hit enter and we're gonna forward.
And perfect as you can see we have the welcome back is back.
So basically if we run a true statement, we see the welcome back.
And if we run a false statement, we do not see the welcome back.
Therefore this indicates that whatever we are injecting is being accepted by
the web application and is being executed on the database engine.
Now,
this slight difference to welcome back and as I mentioned in the previous lecture
could be different depending on the web application.
So sometimes maybe you'll see an image might not load or something
like the pricing in here could be broken or the stars.
You just need to make this very, very abstract.
When you're on a true statement,
you should get something that is very similar to the normal execution of the page.
And then when you run a false statement you should get something else,
it's something should break or something should
disappear or something extra should appear.
But the main thing is the page should be different
based on the statement that you're sending to it.