8

I'm trying to inject SQL into a website. When I write and in the input field the server returns error code 500 and the response delay is 30 seconds.

When I try to add order by or group by the server takes 15 - 30 seconds to respond, and it looks like it's ordering or grouping the result.

So my question is: is this website vulnerable to SQL injection?

Improve this question
2
  • 6
    I think the term you might be looking for is 'blind sqli'
    – schroeder ♦
    Nov 8, 2017 at 19:16
  • yes i thought it's a blind sqli
    – Yanis600
    Nov 9, 2017 at 7:55

1 Answer 1

Reset to default
13

It does seem that the website is vulnerable to a special kind of sql injection called blind SQL Injection.

Especially

This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

and

When the database does not output data to the web page, an attacker is forced to steal data by asking the database a series of true or false questions. This makes exploiting the SQL Injection vulnerability more difficult, but not impossible.

are probably relevant and enlightening.

Or as a more experienced person than me would put this:

In other words, a lack of a response or a lag in a response can be a response itself. There are tools to make use of this and translate true/false answers into meaningful responses over the course of many requests.

On the other hand, a lag might still just be a lag; this is not guaranteed to be an injection.

Improve this answer
5
  • I wouldn't say that blind SQL injection is “a special kind of sql injection”. It is the regular kind; only the process of exploiting it is blind. That is, “blind” refers not to the type of SQL injection, but to the resources/information that the attacker has/gets. (If you wish, you could say that “blind SQL injection” is a type of SQL injection attack, as the OWASP page says: the “blind” refers to the type of attack, not to the type of injection.)
    – ShreevatsaR
    Nov 9, 2017 at 2:28
  • Since SQLi is an attack, I do not see your point in the distinction. It seems you count SQLi as vuln, not as attack.
    – Tobi Nary
    Nov 9, 2017 at 4:21
  • The distinction is hard to make, though. In other cases, this is more clear as the vulnerability is often called SQLi as well. But in the phrasing „vulnerable to x“, „attack“ is implied on „x“.
    – Tobi Nary
    Nov 9, 2017 at 4:29
  • Ah yes good point; I regard “SQL injection” to mean the process/phenomenon of something undesirable getting injected into SQL.
    – ShreevatsaR
    Nov 9, 2017 at 4:30
  • i'm curious why the server took time to responde when i add the 'and' operator but he respondes when i put 'or' operator.
    – Yanis600
    Nov 9, 2017 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .