In this post, I will try to exploit the boolean-based blind SQLi. As the name suggest you will not see any error but you will see data depending on the TRUE or FALSE condition of SQL query.
So let’s begin by login into the bWAPP app and selecting the “SQL injection-Blind-Boolena Based”
This will give you a search page where you can search for movie, lets search for Iron Man and lets see the result. If movie is present in database, we will get the message “The movie exists in our database”
Searching for movie in database
If movie does not present in the database it shows it “The movie does not exist in our database!”. This way functionality is clear to us.
Now let’s use special character such as single/double quote to see if we receive any any message. So if I used single quote I receive the “Incorrect syntax detected” and if I used double quote it says “The movie does not exist in our database!” So using single quote we get some kind of error but not the complete SQL error right which we saw in previous injection techniques.
If I use IRON MAN’ AND 1=1 — it says “The movie exists in our database” and when I changed the 1=1 with 1=2 it says “The movie does not exist in our database!”.
This confirms the application is vulnerable to Blind Boolean Based SQLi. Just to further prove this hypothesis, I used the simple math equation after and which is not true “1+1=3”, lets check this.
False AND statement
Now I will update the equation with the equation which is true.
True AND statement.
Let’s try to find the length of the database and then the name of that database. For this I will us Burp Suite’s repeater and intruder. For this first capture the request in a burp, send it to repeater. Your initial query will look like below:
Initial Request in repeater
Now send this request to intruder and select the 1 and increment it to till 15 and keep noticing the length of response.
Intruder result
If you notice the length of payload with number 5 it is lesser than that of others.
Next task is to find the name of the database, for that we will use substing command along with burp’s intruder.
Burp intruder’s showing first character
As you can see the first character of the database name is “b”, now in same way we can find the other 4 characters keep on mind to make changes in substring function as per our requirement, for example change 1 with 2 as second parameter and after equal to sing add ‘b(a)’.
Second character is w.
After repeating the above steps I finally able to find the all characters i.e. name of database which is “bwapp”
We just need to modify above query every time to find all characters in table name.
IRON MAN’ AND (SELECT SUBSTRING(table_name,1,1) FROM information_schema.tables WHERE table_schema=’bwapp’ LIMIT 0,1)=”a” — &action=search
For all characters we need to change the arguments in SUNSTRING function. Once that is done we need to change the arguments in limit clause appropriately. As we know there is “users” table (from previous write-ups), let’s first find which table it is and then we will try to find all characters for that table name. I will just put each query here.
This is how you can extract the name of other tables. Now we have table name, lets first find the total number of columns, then length of each column name and finally name of columns.
Intruder shows there are 9 columns in the users table.
In similar way we can find the length of all columns by changing the limit clause.Similarly
length of name of 2nd column is 5 length of name of 3rd column is8 length of name of 4th column is 5 length of name of 5th column is 6 length of name of 6th column is 15 length of name of 7th column is 9 length of name of 8th column is 10 length of name of 9th column is 5
Now we have usernames, its time to find the password for that I used list of Alphanumeric characters(A-Z,a-z,0–9) and the query to find the first character is
After multiple iterations through the Burp intruder I am able to find the hash of the password for user A.I.M. and it is “6885858486f31043e5839c735d99457f045affd0”
Same is the hash for the user bee
I tried sqlmap to extract login, password and admin below is the result for the same.
Command used:
sqlmap to extract data
sqlmap final result
In next write-up we will explain the time-based blind sql injection.
