Introduction to Blind SQL Injection

Introduction

Non-Blind SQL injection is the typical "easy-to-exploit" SQL injection that you are likely familiar with. An example could be a vulnerable search feature that returns matching posts that you could exploit by injecting UNION SELECT table_name,table_schema FROM information_schema.tables;-- to list all the tables in the database.

Blind SQL injection is a type of SQL injection where the attacker isn't returned the results of the relevant SQL query, and they must rely on differences in the page to infer the query results. An example of this could be a login form that does use our input in a database query but does not return the output to us.

The two categories of Blind SQL Injection are:

• Boolean-based a.k.a. Content-based, which is when the attacker looks for differences in the response (e.g. Response Length) to tell if the injected query returned True or False.
• Time-based, which is when the attacker injects sleep commands into the query with different durations, and then checks the response time to indicate if a query is evaluated as True or False.

Blind SQLi can occur when developers don't properly sanitize user input before including it in a query, just like any other SQL injection. One thing worth noting is that all time-based techniques can be used in boolean-based SQL injections, however, the opposite is not possible.

Example of Boolean-based SQLi

Here's an example of some PHP code that is vulnerable to a boolean-based SQL injection via the email POST parameter. Although the results of the SQL query are not returned, the server responds with either Email found or Email not found depending on if the query returned any rows or not. An attacker could abuse this to run arbitrary queries and check the response content to figure out if the query returned rows (true) or not (false).

<?php
...
$connectionInfo = Array("UID" => "db_user", "PWD" => "db_P@55w0rd#", "Database" => "prod");
$conn = sqlsrv_connect("SQL05", $connectionInfo);
$sql = "SELECT * FROM accounts WHERE email = '" . $_POST['email'] . "'";
$stmt = sqlsrv_query($conn, $sql);
$row = sqlsrv_fetch_array($stmt, SQLSRV_FETCH_ASSOC);
if ($row === null) {
    echo "Email found";
} else {
    echo "Email not found";
}
...
?>

Conclusion

Up to this point, we've introduced MSSQL and the two types of Blind SQL injection. The best way to learn is to practice, so in the next two chapters we will cover custom examples of boolean-based and time-based SQL injections, and how to exploit them by writing custom scripts.