Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Blind SQL Injection is based on TRUE/FALSE tests. Here is an example:
is first letter A? --> NO
is first letter B? --> YES
is second letter A? --> NO
...
is last letter X? --> YES
It's not a fast method. Do you know something better to guess the word from the database faster?
Your approach to this problem is very bad. You are trying to find letters in the linear time complexity: O(n). Comparing letters, one after the other. It means, that in the pessimistic model you have to check the whole alphabet. Let’s assume that your alphabet consists of only lower-case letters: {a,z}, and your password is zzz. You will have 26 tries to find the first letter, 26 tries to find the second letter and 26 tries to find the last one.
As it was mentioned above, you can speed up this process. Please notice, that the order of letters in the alphabet is always the same (letters are sorted). You can use binary search with O(log(n)) time complexity. This method is used by most people. However, you can speed it up too.
If we know, that the searching password is the dictionary-word, we could use linguistic analysis to build our blind sql injection tries. We could use our knowledge about the frequency of letters in text (for example, the most frequent letter in English is ‘e’). We could also use the knowledge: what’s the probability that after letter X, letter Y occurs. We could also try to guess how many letters X are in our word. In this approach regular expressions can help us a lot. We define the range of characters that will be matched by LIKE (for MSSQL) or REGEXP (for MySQL) functions. Pretty nice explanation about regular expression in sql injection attacks could be find here: http://www.ihteam.net/papers/blind-sqli-regexp-attack.pdf
sleep method is only called when the characters match, so only once per character. You could also sort the characters by average frequency depending on the context. With a binary search, the sleep method is on average called log(n)/(2*log(2)) per character, which is always more often.
The method you are describing has an O(n) time complexity. You can use a binary search which has an O(log(n)) time complexity. I believe sqlmap uses a binary search, there are a number of other implementations.
Some databases like MSSQL allow you to perform DNS lookups, and this can be used as an alternate communication channel with the database.
You can also dump the results of a query to a file using MySQL's into outfile.
Finally sometimes its not actually blind injection, just "hard of seeing". What I mean by that is that you don't need to use sleep() and you can't pull data out directly with a union select, but rather if a part of the query is false or true it affects some part of the page. I used this exploitation technique in simple machines form, where by if the question was true, then a record was found, if it was false then I would get an error "No Messages Found". This can be used along with a binary search to greatly speed up the process of Exfiltrating Data.
You can do your own tests with sqlmap, which includes different types of SQLi attacks.
Because you don't include any environment information, I'm not sure how else to help. Run sqlmap using one type of sqli and compare running times, taking into account variables that might artificially inflate run times.
Do case insensitive, and break it in to chunks...
Does current chunk contain any A's?
WHERE MID(field1,1,40) LIKE '%a%'
If so:
WHERE MID(field1,1,40) LIKE 'a%'
WHERE MID(field1,1,40) LIKE '_a%'
WHERE MID(field1,1,40) LIKE '__a%'
etc.
