Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Blind SQL Injection is based on TRUE/FALSE tests. Here is an example:

is first letter A? --> NO
is first letter B? --> YES
is second letter A? --> NO
...
is last letter X? --> YES

It's not a fast method. Do you know something better to guess the word from the database faster?

share|improve this question
    
Try error based SQL injection. It can read DB values and parameters as a complete word. –  Kapish M Jun 12 '12 at 14:34
1  
This is a really poorly worded question. It is not clear what you are asking. If you are guessing, then use brute force. If you want to extract data, then you are looking at Bsqli or error-based. –  schroeder Jun 12 '12 at 14:39
    
@FirstnameLastname Isn't BSQLi the same as Error-based except that you don't get an overt error message? –  schroeder Jun 12 '12 at 14:55
    
@Firstname Lastname depends on the db, that doesn't work for mysql. –  Rook Jun 12 '12 at 18:35
add comment

4 Answers

up vote 2 down vote accepted

Your approach to this problem is very bad. You are trying to find letters in the linear time complexity: O(n). Comparing letters, one after the other. It means, that in the pessimistic model you have to check the whole alphabet. Let’s assume that your alphabet consists of only lower-case letters: {a,z}, and your password is zzz. You will have 26 tries to find the first letter, 26 tries to find the second letter and 26 tries to find the last one.

As it was mentioned above, you can speed up this process. Please notice, that the order of letters in the alphabet is always the same (letters are sorted). You can use binary search with O(log(n)) time complexity. This method is used by most people. However, you can speed it up too.

If we know, that the searching password is the dictionary-word, we could use linguistic analysis to build our blind sql injection tries. We could use our knowledge about the frequency of letters in text (for example, the most frequent letter in English is ‘e’). We could also use the knowledge: what’s the probability that after letter X, letter Y occurs. We could also try to guess how many letters X are in our word. In this approach regular expressions can help us a lot. We define the range of characters that will be matched by LIKE (for MSSQL) or REGEXP (for MySQL) functions. Pretty nice explanation about regular expression in sql injection attacks could be find here: http://www.ihteam.net/papers/blind-sqli-regexp-attack.pdf

share|improve this answer
    
regular expressions are nice idea - that is what I asked about. –  Mark Q. Jun 15 '12 at 17:48
add comment

The method you are describing has an O(n) time complexity. You can use a binary search which has an O(log(n)) time complexity. I believe sqlmap uses a binary search, there are a number of other implementations.

Some databases like MSSQL allow you to perform DNS lookups, and this can be used as an alternate communication channel with the database.

You can also dump the results of a query to a file using MySQL's into outfile.

Finally sometimes its not actually blind injection, just "hard of seeing". What I mean by that is that you don't need to use sleep() and you can't pull data out directly with a union select, but rather if a part of the query is false or true it affects some part of the page. I used this exploitation technique in simple machines form, where by if the question was true, then a record was found, if it was false then I would get an error "No Messages Found". This can be used along with a binary search to greatly speed up the process of Exfiltrating Data.

share|improve this answer
add comment

You can do your own tests with sqlmap, which includes different types of SQLi attacks.

Because you don't include any environment information, I'm not sure how else to help. Run sqlmap using one type of sqli and compare running times, taking into account variables that might artificially inflate run times.

share|improve this answer
1  
+1 sqlmap is awesome. –  Rook Jun 12 '12 at 18:47
add comment

Do case insensitive, and break it in to chunks...

does current chunk contain any A's? WHERE MID(field1,1,40) LIKE '%a%' if so: WHERE MID(field1,1,40) LIKE 'a%' WHERE MID(field1,1,40) LIKE 'a%' WHERE MID(field1,1,40) LIKE '_a%' etc.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.