SQL Injection - Lab #11 Blind SQL injection with conditional responses

[@RanaKhalil101]

Interested in supporting me and gaining early access to the Web Security Academy videos when they're recorded? Consider buying my course: academy.ranakhalil.com/p/web-security-academy-video-series! ✨ ✨

[@andusefulknowledge]

Rana, Thank you for your efforts. this is omar, and i have a question. when i use the sniper attack in intruder it returns the enumerated password letter by letter, so i follow you again and i use the cluster bomb attack in intruder with two variable $1$ in the substring function and the $a$ in the end for comparison. and i follow exactly the same config as you do, the weird thing is: sniper attack works and returns a letter with welcome back message, cluster bomb never returns any welcome back messages and and all responses returned in cluster bomb attack are all of same length!! is there a bug in my birpsuite? because i can not imagine another reason!! please guide me here :) thank you

[@andusefulknowledge]

update: thank you Rana, I got the Catch! watch for the payload you chose from the list, and for what the cluster bomb actually fills in during the attack. I choose Numbers for payload 1, but during the attack burpsuite was filling mix of letters and other things! seems like a burpsuite problem. the fix: changed the payload type from Numbers to simple list and added integers from 1 to 20 to the list. worked like a charm!

[@mih4743]

I can't tell you how helpful your videos have been. While doing the labs side by side I do it once with you, then again on my own, and it's been night and day in proficient results. I hope I'm lucky enough where you did all the labs in practitioner, so I can follow along and so happy I found your channel. Thanks for your hard work and educational videos. - grateful, newb.

[@saketmahar4493]

Great video. Instead of buying the professional edition, I used a Burpsuite extension called turbo intruder. I created my attack list of numbers from 1 to 100 and gave it to the payload. The attack was completed in 3-4 seconds. Maybe it's even faster than the professional edition itself. XD

[@0xPr3d4T0r]

thanks for this tip ill try it out too

[@anonymous6666]

this content is free, yet invaluable. i wish i was rich enough to donate $5m to Rana, i wonder what benevolent act for the infosec community she'd cook up next

[@MrShreeAB]

You have done a great job... shortly you will have a lot of followers. Amazing format and approach.

[@scottp8329]

Absolutely brilliant vid you explain it so well SQL is something i struggle with well not anymore thanks to you Much appreciated

[@tobywilkins-u4i]

I have been really enjoying your challenge walk throughs. Really clear and well presented. Thankyou

[@cwinhall]

This was the best one yet! Thanks Rana! One thing to note is how this process could be improved by using greater than or less than operators instead of just equal to.

[@omarc900]

i was thinking something similar as well!

[@La_Muerte_Soy]

Can you explain this better, please?

[@jycx3568]

Great video. I could understand Blind SQLi from this video because the explanation was very clear. THX!

[@jmeskay]

These videos are amazing, Rana. Thank you!

[@DuulHomes]

Thank you for being very thorough, and descriptive

[@arunrawat3752]

Like the way you teach you explain as you go which is good for beginners

[@purvashgangolli5968]

Very nice video, seriously this helped me a lot. Thank-you Rana Khalil..

[@La_Muerte_Soy]

Thank you @Rana Khali, great explanation!

[@sharatmaharjan]

Thanks to you ma'am. Many of my doubts are clear now and have concise overview how to think like you as a hacker. But I have one doubt here in this video, please consider answering my question. The main point of SQLI is to find out tables, columns and finally data. Here we may find the "users" table by brute forcing. But how could you find the columns' names by brute forcing or any other techniques when exploiting in real world having no prior knowledge. Thank you ❤❤❤

[@ashishmohanty936]

Really nice and well explained. Also like your clear voice 👍🏻

[@dollarboysushil]

perfectly explained

[@imranthoufeeque]

I have seen your writeups and blog and masha allah its very good and interesting... I humbly request one more writeup or video playlist from you is about BOF... I dont see good resources for this.

[@RanaKhalil101]

Tib3rius has several videos about buffer overflow: kzbin.info/www/bejne/Z4mVe3p8lJ59fa8

[@imranthoufeeque]

@@RanaKhalil101 Jazakallah hu khair

[@InfoSecDojo]

thanks for this series ☺️☺️

[@acronproject]

Thanks for this Ms.Khalil

[@hex_maquina]

Hi Rana, i follow your video and solve the lab using a python script with Binary Search. Thank you for you content!!!

[@cannaml3630]

Very useful, thanks Rana.

[@Esola11]

you mentioned that password can be cracked by scripting with python. more details, about that please ? thank you so much for this in depth details explanation !

[@HamsterLover1337]

Nothing is stopping you from sending HTTP requests using Python

[@tushar7917]

Thank you so much teacher; this helps a lot !!

[@落珰]

Thank you teacher, this helps me a lot

[@ahmedsaleem9327]

First of all great video, well explained MashAllah! Somequestions!!! 1. what if users table exists with a different name like users_jkftb or users_yyytf? 2. What if administrator was named as admin or super user? 3. Does the vendor of the database matter? i think it does based upon if oracle or mysql our payloads would differ. 4. How can we construct an attach methodology that can work irrespective of database vendor and predefined names of tables or users? A real life approach. Thanks AHmed

[@mrpack0x004n1]

you can use the same substring() function for those fields like "database name", "user table name" or "username" if you have access to information_schema.tables with the injection. but it is the same way.

[@thepetiteotaku]

Great video! Thank you.

[@jsmoothstudio9327]

where is the video where you script this in python?? burp community is way too slow to do these labs

[@kingofthesummer5180]

At about 9:00, why did you add the single quote if you commented it out right after ? I’m a bit confused there.

[@Slickjitz]

She mentioned so she wouldn't get a syntax error which cant be in the SQLi since you don't need it in this situation so my only guess would be so Obsidian (the note app she's using) doesn't throw up a syntax error.

[@milosmarkovic4566]

Great Video! If somebody wants to run it on Community Edition, it's not a huge deal, my scan lasted around 35 minutes.

[@amoor89ful]

Al salam alike , Rana, I can't find the SQL injection theory video you mentioned in the first minute of this video can you please share the link, also I want to tell you that you are a very good instructor

[@RanaKhalil101]

Thank you! Here's a link to the video: kzbin.info/www/bejne/Z5-tmKimlrqDe7M&ab_channel=RanaKhalil

[@amoor89ful]

@@RanaKhalil101 I appreciate that thanks and Ramadan mbark

[@MAN-X90-MAN]

thank you so much , can i useing this way for users ... i tallk about brute forcer?

[@skyeagle4635]

Does the community edition only allow one payload set per attack? :(

[@cristhiandamiancastillo3799]

Great video!

[@fabiothebest89lu]

Well, you don't need the cookie editor extension, because nowadays viewing and editing cookies is possible directly from the browser's dev tools

[@steneer6789]

if the table,columns, user names are not given , how can we do the blind SQLi to extract them ?

[@shishiraryal5711]

you used but why? I tried

[@youtubevideostorage3381]

Thanks a million for your awesome awesome videos. I have a request, Please make a video on scrypting with python. Also, when will you release your videos on Lab16 and above?

[@Karmik_bhavya]

is url encoding really necessary ? cause it works fine without it

[@vishaljayaraman4213]

Hii sis, i cant able to apply welcome in filter section, how to fix that

[@keromagdy1803]

excellent work

[@gutserto]

I believe you made a mistake at 17:00 , you also should have changed 'administrator' after the = sign into 'admnistratorfwiofoweow' because if the query checks administratorfwiofoweow with administrator then obviously it will always be false, even if the username administratorfwiofoweow actually exists

[@thepetiteotaku]

I was thinking the same thing.

[@MarhabanBek]

شكرا جزيلا

[@MarhabanBek]

Have you ever tried Bug bounty programs ?

[@bimanroy8865]

Hi Rana, You told that the speed of intruder can be faster by using python scripting. Would you please point me toward any such material which teaches how to do scripting on Burp? Thanks

[@HamsterLover1337]

You cannot do Python scripting in Burp. She is saying if you only have access to the Community edition a clusterbomb attack would take too long and she would rather write a Python script to perform the attack, because it has no built-in throttling like Burp Community Edition.

[@amadoucoulibaly6439]

thank a lot. I really wanna see the python solution 😁

[@abdulx01]

What's name of too that in python script : I don't have professional edition

[@mohemmedahmed7478]

thank you a lot of

[@vaibhavbhatnagar9865]

thanks mam for this video

[@magican208]

My welcome filter is not applying in professional edition can any one help me plz

[@HamsterLover1337]

The results of the cluster could just have been sorted, first descending payload 1, secondly Length descending

[@tortotifa5287]

Hello, salutes from Russia. I have a question: what happened to your voice?

[@shreenathsp7016]

how to get tracking id in latest cookie editor can anyone help me to sort it out please

[@toddvance1568]

Does anyone have a link to a python script tutorial that Rana mentioned? I'd love to see how to do this in Python.

[@RanaKhalil101]

Links to scripts are in the description of the video :)

[@toddvance1568]

@@RanaKhalil101 oh ya I found those eventually... LOVE IT! Thanks so much for all your work!

[@gutserto]

Has someone made a video about clusterbombing using python?

[@thuyakyaw8747]

Thank a lot

[@3D_dreams]

Thnx

[@anirudhsaxena9214]

and (select username from users WHERE username='administrator'and LENGHT(password)>1)='administrator'--' this statement might not work in the burpsuite instead of this go with and(SELECT+'a'+FROM+users+WHERE+username%3d'administrator'+AND+LENGTH(password)>1)%3d'a

[@victornicol2136]

both doesn't work for me do u have any idea ? i use burpsuite community edition

[@anirudhsaxena9214]

@@victornicol2136 try this: and(Select 'a' from users where username = 'administrator and LENGHT(password)>1)='a (make sure to encode it as url by pressing ctrl+u)

[@victornicol2136]

@@anirudhsaxena9214 doesnt work aswell 😕 but i think thé error com from the lenght command function because i tried with other values and it never work that weird : ' and (select 'a' from users where username='administrator' and lenght(administrator)>1)='a i feel like im missing something really stupid haha

[@anirudhsaxena9214]

@@victornicol2136 you are not getting welcome back message through this or getting protocol error

[@anirudhsaxena9214]

@@victornicol2136 broo thatsss notttttt lenght(administrator) that's LENGHT(password )🥲🥲🥲🥲

[@krzysztofswidrak1471]

U think you could also make a grep match filter like "Welcome back!" or all

[@rohit_62]

Everyone has different password for the exercise so please don't copy from here and better do it . Thank me later .😅

[@8124K-u4x]

abla hızlı ol ak

[@StudiofrogPl]

most stupid exercise on portswigger. Why do SQli when you can brute force with hydra. Waste of time.

[@slavicslav7459]

Well try and do that. Try brute-forcing a password, that is 20 characters long. In this lab, you have a specification, that the password is made up using only lowercase characters. That is 26 characters per slot. That is 20^26. The number is so large, you can not put it into a scale, that the human brain could comprehend. A modern computer can hash let's say 70k hashes a second. It would take 3040011596723926000000 years to break this password. Good luck with that.

[@magican208]

My search filter is not working in both normal and in professional can anyone help me plz.