Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

After scanning my website with uniscan I found a few vulnerabilities. I found this answer here and tried but it does not return anything except what it should return.

Blind SQL Injection:

[+] Vul [Blind SQL-i]: http:/192.168.1.100/browse.html?user_id=10590'+AND+'1'='1     
[+] Keyword: Compassion

How to use the keyword in order to inject successfully?

share|improve this question
    
Do you get a different result with 10590' AND '1'='0? –  Gumbo Apr 30 at 8:02
    
No, i get a different result if i write id=10590 only http:/192.168.1.100/browse.html?user_id=10590 –  FilipLuch Apr 30 at 8:04
    
If 10590' AND '1'='0 and 10590' AND '1'='1 don’t have different results, you’re probably not vulnerable. Or what exactly is the difference in both? –  Gumbo Apr 30 at 8:05
    
user_id=10590 != user_id=10590'+AND+'1'='1 == user_id=10590'+AND+'1'='0' does that make the website vulnerable? –  FilipLuch Apr 30 at 8:12
1  
The expression '1'='1' in 10590' AND '1'='1 would make the condition true for each row while '1'='0' would be false for each row. If you don’t get a different result, it’s not vulnerable. That 10590 and 10590' AND '1'='1 gives you different results is probably because there is no user with the id 10590' AND '1'='1. –  Gumbo Apr 30 at 8:17

1 Answer 1

up vote 1 down vote accepted

What the vulnerability scanner tried is to add a condition that is either true for all rows ('1'='1', tautology, added with 10590' AND '1'='1) or false for each row ('1'='0', contradiction, added with 10590' AND '1'='1). If you don’t get a different result for these, it’s probably not vulnerable.

However, that the user_id values 10590 and 10590' AND '1'='1 gives you different results is probably because there is no user with the ID 10590' AND '1'='1.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.