So now that we know that the target web application
is actually vulnerable to a time based blind SQL injection.
We know that all we have to do right now is exploit this vulnerability to get the
data that we need and we're going to do that by manipulating the time delay in here.
Again, similar to what we did in the previous class,
we're gonna ask the web application questions like do
you have a table that is called users?
If it sleeps for a certain period of time then we know that it does.
If it doesn't,
then we move on to the next guest and then once we
discover a database name or a table name that we're interested in,
we're gonna guess the column name.
And once we know the column name we're going to get the user name and the password
pretty much in a similar style to what we've done in the previous lecture.
But there will be different slight differences because
like I said in the previous one,
we were simply relying on changes on the page that is loading
in this example, the page is not changing at all.
And we're simply going to be relying on the time delays to tell
us whether a certain table or a certain user exists on the database.
So if you go here to the
you can see that we have conditional time delays.
And again, you have a different statement for each database engine
and let me explain to you how we can use
this conditional time delays to extract data from the database.
So we're basically doing a select statement
and we're gonna use a case query or a case
statement and what we're saying in this if or when
a certain condition is true then I want you to
sleep for 10 seconds otherwise do not sleep at all.
And that would be the end of it.
So you can see this is a very common
way of writing conditional statements in programming in general
and this is simply just the syntax that postgres SQL uses.
So we're simply using a conditional statement.
This is the way you write a condition imposter SQL using
the case statement after the one you specify the condition.
So on this we're saying two is equal to two which is always true.
Then we're saying sleep sleep 10 seconds otherwise sleep for zero seconds.
So basically don't sleep at all.
And this will actually be another way for us to confirm that the
target web application is vulnerable to a time based blind SQL injection.
So we'll first ask it to sleep for 10 seconds if two is
equal to two and we know that two is equal to two.
So it should sleep for 10 seconds and then the next time I'm gonna ask it to sleep
for 10 seconds if two is equal to one and we know that two is not equal to
one and therefore we know that that should fail
and we should sleep for zero seconds and that
should confirm to me that the target web application
is vulnerable to a time based SQL injection.
So we're simply just gonna say select case
when and we're going to specify our conditions.
So two is equal to two. Then
we wanted to pg sleep for 10 seconds. Otherwise we want you to pg
Sleep
for zero seconds
and then that's the end of it and then we
have to put this in whatever we're injecting our code.
So in here we're basically gonna put it between the
two bars in here and the two dashes the comment.
So I'm gonna paste it
and I should have put a open bracket in here
And a closed bracket in here because we have a full statement
in here so we have to enclose it between two brackets.
So again we hit enter and let's send it again and as you can see
this is taking some time so it should take about 10 seconds to load.
And because it took 10 seconds that it's highly likely that it's executed my code
because I'm saying if two is equal to two then sleep for 10 seconds.
Now let's say if two is equal to one then I want you to sleep for 10 seconds.
So that's obviously false and therefore the Web application should load quickly
and perfect as you can see the response
came straight away which means that it's actually executing
this part of the statement if this condition
is true and otherwise it's executing this part.
So it's sleeping for zero seconds.
Therefore we can use this very statement to
extract a lot of information from the database.
For example, we can simply say,
I want you to select if two is equal to two then to sleep for 10 seconds.
Otherwise sleep for zero seconds From users.
So we're basically saying select a true condition,
sleep for 10 seconds if that's true otherwise don't from users.
So if we have a table that is called users, we're gonna sleep for 10 seconds,
otherwise we're not.
And this way we're going to check if there is a table that is called users.
So all we have to do is go back to our statement in here,
go to the end of it and just say from users
hit enter and this is actually should be two is equal
to two because we want this condition to be true.
And then we're gonna send
and again, it seems like it's taken some time,
which is a good indication that there is actually a table that is called users.
So whenever you get a true statement,
it's a really good idea to make that statement false as well just to make sure that
whatever you're executing is actually being executed and you're
not just being biased about what you're doing.
So now that we know that there is probably a
table that is called Users because of this statement,
we're simply going to go back to the table that we have in here, which we
are pretty sure that it exists.
But I'm just gonna make sure that I put a name that doesn't exist.
And I'm gonna double check that web application should not sleep for 10 seconds.
I should get a quicker response times in 10 seconds.
And this way I will know that the
previous statement that I executed is definitely correct.
So I'm simply just going to add la la la la la to the end
And we're gonna send it
and perfect as you can see now we've got
the response straight away which means that whatever we executed
in the previous statement when we simply typed users
and then the Web application waited for 10 seconds.
That means that we actually do have a table in the database that is called users.
So the next question that we're gonna ask is again,
we're gonna select case if the user name is equal administrator from users,
then sleep for 10 seconds.
Otherwise don't do that. Don't sleep for any seconds.
So as you can see, we're basically using the same statement over and over again,
we first had to build a statement that based on a
it either sleeps for a certain period of time or it doesn't.
And then all we do is we simply manipulate that condition and monitor the amount of
time the web application is sleeping for to
determine whether this condition is true or not.
So now we're simply just going to test if
there is a user name that is called administrator.
So all we have to do is simply modify this condition in here and
we're gonna set that to if the user name is equal to administrator.
Let's hit enter and let's see if we're waiting and it looks like we are waiting.
Now you can obviously change the wait time to five seconds
if you don't want to waste a lot of time,
that really depends on the web applications.
Some of web applications are slower to response,
so having a slower response time might be a bit annoying and
harder to determine the difference between a false and a true statement.
But as you can see based on the response,
we probably do have a user name called administrator.
But again, just to make sure,
let's just go ahead and change the administrator in here
and just type something that does not exist like administrator.
And let's just add la la la la la to the end and And let's hit sand
and we get an instant response meaning that there is no user name that is called this.
But as you saw earlier,
we waited for 10 seconds when we used administrator like so and therefore now we
know that we have a user name on the target database that is called administrator.
So now the next goal is to actually get the password and this is going to be
similar to what we did in the previous
example with the exception of this new statement.
So like I said,
all we're doing is we're modifying the
condition in here and therefore the next statement
that we're gonna run is going to be very similar to what we did previously.
So we're checking if the user name is administrator and
the length of the password is greater than one.
So we're trying to determine the length of the password first
before we can start determining the actual value of the password.
So again, we're going to go back to our statement,
we're gonna come back in here and we're just gonna
say and length of the password is greater than one.
So we're simply just asking the web application if
is the length of the password greater than one.
If it is then I want you to sleep for 10 seconds.
So let's send it and we should actually wait if what we're doing
is correct because the length of the password should be greater than one.
And as you can see because we're waiting for very
long we know that it is greater than one.
So that's perfect.
Now if you want to confirm this you can also do greater
than 100 to make sure that again your statements are working right.
But I'm not gonna do that because I'm pretty sure my statements are correct.
So I'm just gonna check if the length is greater than 20.
Now we're gonna hit enter and let's send it and we get an instant response.
So now we know the length of the password
is actually smaller than 20 but greater than one.
Now again as you can see there's a bit of guessing in this which could take a
bit of time but I've done it before and now the length of the password is 20.
But just to confirm,
I'm gonna replace the greater sign with an equal as you can
see here we're going to hit enter and let's send it and we
should be waiting for 10 seconds because we're guessing the correct length
of the password we're saying is the password length equals to 20.
And as you can see because it's taking 10 seconds to get back to me,
we know that the length of the password is 20 characters.
So the next goal is to determine that password.