Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Firstly, from what I have read so far, boolean based blind sql injection is you can't see any error messages and rely on true or false query to milk the database.
eg. Craft a query that will ask the database is the the first character of the table schema name is an "E" or whatever? And you will keep asking until you got the database name, table name and column names to dump the information you wanted..

I understand that there is also time based blind sql injection but I'm not concern about that.

Secondly, I have seen many youtube videos/articles saying what they have shown is a blind sql injection(because no error messages shown). However, they still are able to use UNION SELECT query to pull information out from the database.
eg. id=1' UNION SELECT 1,2,3,table_name from information_schema.tables
Isn't this counted as UNION based sql injection? If not, what is this called?

Is there anything wrong with my understanding? By right a pure blind sql injection doesn't allow you to use UNION statements am I right?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Most of what you say is correct.

The UNION statement in regard to SQL injection is just another way to attempt to break/change/extract data. It can be blind, partially blind, or not blind at all, this depends on the server, code, and error reporting.

If the injection doesn't output any data, but does effect the behavior of the site in a way that you can interpret as having done something different than normal, it is considered partially blind.

If the injection doesn't output any data, and there is no change in behavior of the site at all, this is considered totally blind.

Using UNION may or may not change the outcome, but isn't inherently linked to being blind or not.

share|improve this answer
    
So example if a website is changes its look upon a ' inserted but no error msg is displayed and I used union to dump the information. It is a partially blind sql injection? –  ysj Jun 8 '13 at 14:11
add comment

UNION SELECT based SQL injection is not considered blind, and neither is error-based SQL injection. So the videos you found are indeed incorrect in their descriptions.

It is blind if you cannot directly see rows from the database output into the page. With UNION SELECT SQL injection, parts of the page will contain data from tables and columns that were not intended to be included by the original coder. And with error-based you get the same, just it's in the output of error messages.

Blind SQL injection means none of the rows in the database are directly disclosed onto the page. Examples typically include if you find SQL injection inside of an INSERT or DELETE statement, or inside a SELECT statement that immediately throws away, or otherwise does not output, the data it retrieves.

For example, if you had some login code that looked like query("SELECT username FROM users WHERE username='$username' AND password='$password'");, where either $username or $password are injectable, odds are the result of this query won't actually be output anywhere. It is simply a "check", not a retrieval. In this case your only option is to use blind injection. In a case like this, you could use blind injection to read data from any table, or you could use it to login without knowing the password. Blind injection is not always limited to extracting data from the database, it can also include making actions that the author did not intend by abusing the results of SQL queries.

Blind injection is split into two kinds: boolean blind and time-based blind. Sometimes boolean blind is called "partial blind" and time-based is called "full blind" but I find those to be kind of unclear.

Boolean injections are the easier one to exploit, but may not be found in all cases. All blind SQL injections (really, all SQL injections anywhere) will be vulnerable to time-based blind injection as long as the database application has some kind of function or feature that can delay the response for at least a second or two. Most big databases do have such functions. The disadvantage is that it may take a long time to extract large amounts of data.

I'll leave you to research exactly how those blind injections work, but your description of boolean blind injection is correct.

share|improve this answer
1  
I prefer to use union select statements to access other tables in my blind sql injection exploits. This post is misleading. –  Rook Jun 9 '13 at 22:06
    
@Rook Could you give an example? I'm pretty sure 100% of the time that one could use UNION SELECT inside a blind SQL injection, you could just use a SELECT subquery (which will be more versatile anyway, since it'll work when the statement you're injecting into doesn't begin with SELECT). UNION SELECT only has to be, or should be, used with non-blind SQL injection. –  Anorov Jun 10 '13 at 3:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.