SQL Injection - Lab #14 Blind SQL injection with time delays and information retrieval

[@RanaKhalil101]

Interested in supporting me and gaining early access to the Web Security Academy videos when they're recorded? Consider buying my course: academy.ranakhalil.com/p/web-security-academy-video-series! ✨ ✨

[@Bixsu-]

Thanks for these videos! As a complete beginner I didn't quite understand how a SQL command is executed step by step, your explanations provide some insight that the Web Academy doesn't.

[@Vinayak123-q8p]

amazing, this could be probably one of the biggest information that i have ever been given. we need such playlist more and more in upcoming days. we need all portswigger lab solution.

[@jack84639]

عاشت ايدج خالة 😍 صوتج يموت

[@Rexsisodia]

Where we find Resource pool tab 🙄

[@gopikanna_]

I'm having the same issue, have you fixed it?

[@tazaccking7467]

mam perfect explanation thank you

[@techtutorials7026]

thanks for great explaination...

[@LeChaser421]

Hi Rana! Just wanted to thank you for the awesome vid and great explanation! Do you have a payload list that you use to id these vulns in the wild, or do you go from your knowledge on what would work and whatnot?

[@milosmarkovic4566]

If anyone is using MAC and struggling to find the 'Columns' tab while filtering results from the attack, don't forget to look at the very top of your screen, it's not like on the video, don't be like me, and look everywhere in the Burp :')

[@ЛуарвикЛ.Луарвик]

Great solution! Thanks for sharing!

[@carloa6288]

Hi, thank you so much for your videos! Can you make a short video (or explaination) how to use/compile your Py code? (in case we are using burpsuite borwser, is it different?). Thank you again! :D

[@camtap757]

Hey Rana, First I want to say I love your videos. They are very helpful and the explanations really help me understand the material. I have encountered a problem with Lab 13 and 14. I follow your steps and even double check the query syntax from the given solution from Port Swigger. I am able to enumerate the password, however, every password I get is wrong. Any idea what could cause this? Thank you so much!

[@balajikrishna751]

very useful

[@webtzr]

Can you make tutorials on what you have learn from OSCP.plz...

[@RanaKhalil101]

this video is coming up soon :)

[@webtzr]

@@RanaKhalil101 are you planning to make a course on OSCP Or just a intro video??

[@hybridsh4d0w]

this would be an awsome series I would even pay for it !

[@odesconhecido8565]

i have a question. How i confirm that param is vuln? i go and test some payloads on param randomly?

[@ahmedsaleem9327]

in the previous video she sent pg_sleep(10) after figuring out its portsgre DB so thats how you confirm.

[@TriNguyen-dl9uu]

hi, I'm having a problem cracking the password with a slightly different query that I believed is correct:' || (select case when (1=1) then pg_sleep(3) else pg_sleep(0) end from users where username='administrator' and substring(password, 1, 1) = 'a' --. When I use intruder in burp, for some reason it didn't work. Could you please take a look and give me some feedback?

[@rayanchoudhury8299]

FIRSTLY, I think it will be better if you give the time delay something like 10, it will be easier to observe. SECONDLY, I think (1=1) is the part that is causing the error. instead of 1=1 it will be username = 'administrator' and substring(password, 1, 1) = 'a'. I created my own query you can check it out ' || (SELECT pg_sleep(10) FROM users WHERE username = 'administrator' and substring(password,1,1) = 'a')-- Here, first it checks if the table and the username exists or not. After that, it checks the next part which is the substring part. When it is FALSE, it just loads normally BUT if it is correct, it runs the SELECT part which is pg_sleep(10) and therefore we get the delay. My query is shorter because i didn't bother writing the THEN and ELSE part since I realized that even if I skip it I get the same results. BUT WHY?? It is simply because if any part from the FORM part is FALSE, it doesn't run the SELECT part (AS LEARNT ON THE PREVIOUS LAB) and therefore not triggering the time delay

[@gvlspace]

did you try url encoding and changing the time delay from 3 to 10secs as I guess we may feel some seemingly false positives if the time delay is too little here? Also, was it burp community edition or professional? I have tried your query after url encoding and keeping the delay at 10. It has worked. Hope it helps! From burp intruder: Cookie: TrackingId=GMbdXi2vewPdv45S'||+(SELECT+CASE+WHEN+(1=1)+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END+FROM+users+WHERE+username%3d'administrator'+AND+SUBSTRING(password,§1§,1)='§1§')--; session=NIzq0HagUUIo0O25LXrs7XNcEItVDmXA

[@ahmedsaleem9327]

you can also use the following payload to confirm if administrator user exists. || (Select pg_sleep(10) from users where username ='administrator')--

[@DuulHomes]

Doesn't it always automatically url encode? I found no need of doing it!

[@abdulx01]

I have only one problem How can I learn the SQL command query: BY the way My Web security progress is going to be very awesome 😊

[@nikhilbartake5361]

Hi I have a question, How do i carry out the end attack without resource pool. Do I mess with the request engine settings?

[@ahmedsaleem9327]

yes, use 1 thread it will give u defined delays