2

I've tried doing an SQL injection on a website using the Hack Bar. The server did not respond to SQL errors.

I've also tried using sqlmap:

sqlmap -u http://website/login.php?op=login --dbs
sqlmap -u http://website/login.php?id=1 --dbs
[10:06:33] [CRITICAL] all tested parameters appear to be not injectable.

So my question is: Is it possible to get an SQL injection, even if the web server does not show any error?

3
  • Yes, but SQLMap doesn't just look for errors. For example, it will try time based attacks, where the length of time a query takes to return can be influenced to read data. These kind of attacks can allow injections without any errors at all.
    – Matthew
    Nov 2 '16 at 14:16
  • Okay, this would mean that the website is not vulnerable to both SQL injection and blind SQL injection, right? Thanks! Nov 2 '16 at 15:34
  • Sadly no - SQLmap is good, but it's not perfect. The only way to be completely sure would be to perform a full source audit of the code, ensuring that there aren't any points where SQL statements can be modified by end user input in a dangerous way - I've seen cases where SQLmap misses fairly simple injections (and reported to the devs to help improve it) which just aren't part of the flaws it knows.
    – Matthew
    Nov 2 '16 at 15:48
5

Yes, it's called Blind SQL Injection, which is quite hard, but not impossible.

If you can query for a lot of true / false values, then it's a Content-based Blind SQL Injection.

Another common method is the Time-based Blind SQL Injection, where you basically instruct the database to perform a time-intensive operation. If the web site does not return a response immediately, the web application is vulnerable to Blind SQL Injection. Mostly, the sleep operation is used.

yoursite.com/index.php?id=1337 and if(1=1, sleep(42), false)

If the page doesnt reload asap, it's vulnerable.

1

There is a concept called blind SQL injection. It deals with the situation that a parameter is vulnerable to injection but errors are dealt with internally from within the program and the attacker is not able to see the error message or that an error occurred, respectively.

Check out this tutorial, it explains stuff in more detail.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.