8

I'm trying to inject SQL into a website. When I write and in the input field the server returns error code 500 and the response delay is 30 seconds.

When I try to add order by or group by the server takes 15 - 30 seconds to respond, and it looks like it's ordering or grouping the result.

So my question is: is this website vulnerable to SQL injection?

  • 6
    I think the term you might be looking for is 'blind sqli' – schroeder Nov 8 '17 at 19:16
  • yes i thought it's a blind sqli – Yanis600 Nov 9 '17 at 7:55
11

It does seem that the website is vulnerable to a special kind of sql injection called blind SQL Injection.

Especially

This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

and

When the database does not output data to the web page, an attacker is forced to steal data by asking the database a series of true or false questions. This makes exploiting the SQL Injection vulnerability more difficult, but not impossible.

are probably relevant and enlightening.

Or as a more experienced person than me would put this:

In other words, a lack of a response or a lag in a response can be a response itself. There are tools to make use of this and translate true/false answers into meaningful responses over the course of many requests.

On the other hand, a lag might still just be a lag; this is not guaranteed to be an injection.

  • I wouldn't say that blind SQL injection is “a special kind of sql injection”. It is the regular kind; only the process of exploiting it is blind. That is, “blind” refers not to the type of SQL injection, but to the resources/information that the attacker has/gets. (If you wish, you could say that “blind SQL injection” is a type of SQL injection attack, as the OWASP page says: the “blind” refers to the type of attack, not to the type of injection.) – ShreevatsaR Nov 9 '17 at 2:28
  • Since SQLi is an attack, I do not see your point in the distinction. It seems you count SQLi as vuln, not as attack. – Tobi Nary Nov 9 '17 at 4:21
  • The distinction is hard to make, though. In other cases, this is more clear as the vulnerability is often called SQLi as well. But in the phrasing „vulnerable to x“, „attack“ is implied on „x“. – Tobi Nary Nov 9 '17 at 4:29
  • Ah yes good point; I regard “SQL injection” to mean the process/phenomenon of something undesirable getting injected into SQL. – ShreevatsaR Nov 9 '17 at 4:30
  • i'm curious why the server took time to responde when i add the 'and' operator but he respondes when i put 'or' operator. – Yanis600 Nov 9 '17 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.