2

I'm following this tutorial on Pentesterlab about SQLi, and they're talking about Blind SQL. From what I thought blind SQLi was needed when you don't see (error) output from your target, and you can only use fase/right/slow/fast to see if your query is true or works.

But in that tutorial they start about bit masking and I don't know whatever. I know that bitmasking exists out of:

  • Extracting: AND (used in this tutorial)
  • Setting subset: OR
  • Toggling: XOR

And 'AND' works example like this:

MASK: 100110
VALU: 101010
RESU: 100010

Only '1' where value and mask are '1'.

However, how is this used in Blind SQLi? And why that script they use in the tutorial?

tl;dr Why do they use bitmasking in Blind SQLi, I guess I don't understand Blind SQLi completely.

1 Answer 1

4

I thought blind SQLi was needed when you don't see (error) output from your target, and you can only use fase/right/slow/fast to see if your query is true or works.

Correct, in a blind SQL injection you can only evaluate if the result of a query is true or false.

So, how would you fetch a value from the database if you can only ask yes/no questions?

You would surely ask for each letter separately. But that would still be at least 62 possibilities (assuming a-zA-Z0-9) per character. Therefore, the idea presented in the tutorial is to ask for each bit individually. This way you need exactly 8 queries per byte to determine its value. So all you do is transform the value you want to read into binary and successively ask for every bit if it's 1.

Say, you want to retrieve the value "secret". So you start by extracting the first character:

substring('secret',1,1) -> 's'

Then you get its ASCII value:

ascii('s') -> 115

Now you apply a bitwise "and" (&) to isolate the value of the first bit:

115 & 1 -> 1

  1110011
& 0000001
---------
  0000001

The result is 1 which makes the statement true.

If you apply this method for every bit of every character of the value you want to read, you'll eventually get the entire string by just evaluating if your queries are true or false.

3
  • Okay, but you than still have to check the masks '0000010' and '00000100' to make sure all the bits are true, and by that the whole character is true? And we could actually also do it by a-zA-Z0-9 in theory, but bitmasking is just a lot faster?
    – O'Niel
    Dec 21, 2016 at 22:10
  • @O'Niel You don't make sure "all bits are true". You check each bit to learn its value. And this bit sequence can then be converted back to the character value. I'm not sure what you mean by "the whole character is true" since a character can't be true or false.
    – Arminius
    Dec 21, 2016 at 22:24
  • @Arminus ah okay! So if 'secret' would be our string, this would be our binary: '011100110110010101100011011100100110010101110100' and we get the value by starting with 00..001 at the most right, and than 00..010,... and so we get the value? Because two ones beneath each other return true.
    – O'Niel
    Dec 21, 2016 at 23:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .