Welcome to the first lesson in our module on Advanced Manual SQL Injection. In the previous module, we successfully performed a full, end-to-end attack, but we relied on the application providing direct feedback—either through error messages or the results of our UNION queries. This is known as in-band SQL injection.
Today, we delve into a more challenging and common scenario: blind SQL injection. We will explore what happens when the application provides no direct output. Specifically, you will learn how to perform a Boolean-based blind SQL injection, a technique where you extract data one "yes" or "no" question at a time by observing subtle changes in the application's response. This is a fundamental skill for any security analyst, as many real-world vulnerabilities are blind.
From Direct Output to Indirect Clues
In an in-band attack, the application is cooperative, showing you the data you request. In a blind attack, the application is silent. It doesn't return data from the database or specific error messages in its HTTP response. Instead of seeing the data, we must infer it.
The core idea behind Boolean-based blind injection is to ask the database a series of true/false questions and watch for any difference in the application's behavior.
To start, let's get a clear definition of blind SQL injection and the two primary techniques used to exploit it: Boolean-based and time-based.
This video from The Cyber Mentor provides a concise introduction to the concept of blind SQL injection.
Watch the segments that define blind SQLi and introduce the two main techniques. Start from the beginning to understand what blind SQL injection is and why it's a subtle but powerful attack. Continue with the explanation of the two primary methods: Boolean-based and time-based attacks. We will focus on the Boolean-based method in this lesson.
The Logic of Conditional Responses
The key to a Boolean-based attack is to construct SQL queries where an injected condition determines whether the original query returns any results. If the application's response is different when a query returns data versus when it returns no data, we can exploit this.
The following resource from PortSwigger, the creators of Burp Suite, explains this mechanism in detail.
What is Blind SQL Injection? Tutorial & Examples
This article from the Web Security Academy is the definitive guide to blind SQL injection theory.
Please read the following sections carefully: First, read the introductory sections What is blind SQL injection? to solidify the definition. Then, read the entire section Exploiting blind SQL injection by triggering conditional responses. This is the most important part of the reading. Pay close attention to the example of testing for a true condition (' AND '1'='1') versus a false condition (' AND '1'='2'). Understand how this logic is extended with the SUBSTRING function to extract a password one character at a time.
Hands-On Lab: Exfiltrating a Password, Bit by Bit
Now it's time to see this theory in action. We will follow a guided lab exercise from PortSwigger's Web Security Academy, demonstrated by security researcher Rana Khalil. This lab perfectly mirrors the scenario described in the reading: a tracking cookie is vulnerable to blind SQL injection, and a "Welcome back" message serves as our true/false indicator.
The process of exploiting a Boolean-based blind SQLi vulnerability follows a clear, methodical path:
- Confirm the vulnerability by injecting simple true and false conditions and observing the response.
- Determine the length of the data you want to extract (e.g., a password).
- Extract the data character by character by iterating through positions and possible characters.
The following video will walk you through each of these phases.
SQL Injection - Lab #11 Blind SQL injection with conditional responses
This video provides a complete, step-by-step walkthrough of exploiting a blind SQL injection vulnerability with conditional responses.
Follow along as Rana Khalil demonstrates the attack. Understand the Lab and Confirm the Vulnerability: First, watch from the beginning to understand the lab setup. The target is a TrackingId cookie, and the indicator is a "Welcome back" message. Next, watch the critical process of confirming the vulnerability. Observe how she injects ' AND 1=1 (true condition) and ' AND 1=2 (false condition) to verify that the application responds differently. This is the foundational step for any blind injection attack. Determine the Password Length: An efficient attacker first finds out how much data they need to steal. Watch from this section to see how she uses the LENGTH() function within the injected query. She asks a series of questions: "Is the password length > 1?", "Is it > 50?", and so on, narrowing down the possibilities. Notice her use of Burp Intruder to automate this, which is a standard professional practice. Extract the Password Character by Character: Finally, observe the data exfiltration itself. This segment from the video explains the logic for the final payload. The query uses SUBSTRING(password, X, 1) = 'Y' to ask, "Is the character at position X of the password equal to Y?". By iterating through X (from 1 to the password length) and Y (from 'a' to 'z', '0' to '9', etc.), the entire password can be reconstructed based on when the "Welcome back" message appears.
As you saw in the video, manually performing this attack for a 20-character password would require hundreds or even thousands of requests. This is why automation tools like Burp Intruder are indispensable.
For a different perspective and a detailed written guide on using Burp Intruder for this exact type of attack, you can review the following article. It complements the video by showing screenshots of the Intruder configuration.
Blind SQL Injection with Conditional Responses
This Medium article provides a detailed textual and visual walkthrough of the same lab.
Skim through these sections to reinforce your understanding of the automation process: Password Length: See how the author uses a query with the LENGTH() function to find the password length, first manually and then with Intruder. Automating with Burp Intruder: Look at the screenshots showing how to set up a "Sniper" attack in Intruder to find the password length. Extracting Password Character-by-Character: Finally, observe the setup for the "Cluster bomb" attack, which automates the final character-by-character extraction.
Conclusion
In this lesson, you have moved beyond in-band SQL injection into the more subtle world of blind vulnerabilities. You have learned the logic behind Boolean-based attacks and seen the methodical process required to exfiltrate data when you cannot see it directly.
Key Takeaways:
- Blind vs. In-Band: Blind SQL injection occurs when the application doesn't return database errors or query results in its response.
- Boolean-Based Logic: This technique relies on asking the database a series of true/false questions and observing a differential response in the application (e.g., one message for
true, another forfalse). - Systematic Exfiltration: The attack is a multi-step process: confirm the vulnerability, determine the length of the target data, and then extract the data character by character using functions like
LENGTHandSUBSTRING. - Automation is Essential: Due to the high number of requests required, manual exploitation is often impractical. Tools like Burp Intruder are essential for efficiently performing blind SQL injection attacks.
This technique is powerful, but it has a limitation: it requires a visible change in the application's response. What if the application returns the exact same page for both true and false conditions? In our next lesson, we will tackle this challenge by learning about time-based blind SQL injection, where we force the database to wait, using time itself as our only indicator.