Why using bitmasking in Blind SQLi?

Question

I'm following this tutorial on Pentesterlab about SQLi, and they're talking about Blind SQL. From what I thought blind SQLi was needed when you don't see (error) output from your target, and you can only use fase/right/slow/fast to see if your query is true or works.

But in that tutorial they start about bit masking and I don't know whatever. I know that bitmasking exists out of:

• Extracting: AND (used in this tutorial)
• Setting subset: OR
• Toggling: XOR

And 'AND' works example like this:

MASK: 100110
VALU: 101010
RESU: 100010

Only '1' where value and mask are '1'.

However, how is this used in Blind SQLi? And why that script they use in the tutorial?

tl;dr Why do they use bitmasking in Blind SQLi, I guess I don't understand Blind SQLi completely.

Answer 1

I thought blind SQLi was needed when you don't see (error) output from your target, and you can only use fase/right/slow/fast to see if your query is true or works.

Correct, in a blind SQL injection you can only evaluate if the result of a query is true or false.

So, how would you fetch a value from the database if you can only ask yes/no questions?

You would surely ask for each letter separately. But that would still be at least 62 possibilities (assuming a-zA-Z0-9) per character. Therefore, the idea presented in the tutorial is to ask for each bit individually. This way you need exactly 8 queries per byte to determine its value. So all you do is transform the value you want to read into binary and successively ask for every bit if it's 1.

Say, you want to retrieve the value "secret". So you start by extracting the first character:

substring('secret',1,1) -> 's'

Then you get its ASCII value:

ascii('s') -> 115

Now you apply a bitwise "and" (&) to isolate the value of the first bit:

115 & 1 -> 1

  1110011
& 0000001
---------
  0000001

The result is 1 which makes the statement true.

If you apply this method for every bit of every character of the value you want to read, you'll eventually get the entire string by just evaluating if your queries are true or false.