Sorry in advance if this is a noobish question, but I can't seem to find the right phrasing to get the answer on google or here--I'm pretty new to SQL and am working on a SQLi challenge that is a blind injection. The page returns no information unless you either run a query successfully or use quotation marks in a pattern that I haven't been able to identify, in which case it says "you can't do that". It is silent if you cause any sort of error with your input. As a result I haven't been able to figure out what the backend is, what varient of SQL is being used, what the database name is or what the table names are.
The statement being run must be something like "SELECT * FROM table WHERE title='
". The site will allow me to dump all the entries of the table it's querying from by injecting something' OR '1' = '1
. I know there's another table in the database containing information that I need to get at (a flag), but if I try something like something' UNION SELECT * FROM users WHERE '1' = '1
, it returns "you can't do that". Even after a lot of fooling around with it I haven't been able to figure out on what criteria it filters quotes--the UNION statement I tried has the same amount of quote characters as the OR '1' = '1 statement that DOES run, and adding superfluous quotation marks that don't change the meaning of the query (adding random open and close quotes, putting a single quote in a comment in the middle of the query) sometimes triggers the "you can't do that" and sometimes does not. I haven't been able to identify a pattern.
My question is this: Is there a way that I can fool it into thinking I'm using the right number/pattern of quotes, such as a pattern that I already know works, but also include a hex-encoded UNION statement that would be run as part of the query? I've been trying things like something' OR '1' = '1 CONVERT(varbinary(max), <hex code for ' UNION SELECT * FROM users WHERE '1' = '1>)
but not getting any results. Since the injection is blind I can't tell if I'm doing something that's a syntax error (does that CONVERT statement actually turn the hexcode into ascii that would then be executed as part of the query?) or if my logic is off. If somebody could let me know if what I'm doing makes sense and/or point me in the right direction that would be greatly appreciated.
Thanks!
something' OR '1' = '1'; [Insert another query here]
something' OR '1' = '1 CONVERT
and the hex for closing the quote on the 1, the semicolon and the next query up until the closing quote but it doesn't work (returns nothing). I'm wondering if I'm using CONVERT wrong or if I just don't know the right table name.something' OR '1' = '1
works to begin with, then you can just expand from there. The reason why I suggested a semicolon is because it allows you to escape the first query and run a completely new one. Remember when you're making your new query though, that it's expecting your query to end with an apostrophe and you must not include it in the line itself, as it is automatically inserted by the vulnerable app.