Blind SQL injection: understanding heavy queries

Question

This article (PDF) talks about a blind injection technique based on heavy queries.

Questions:

1. Can anyone explain to me the purpose of using heavy queries while compared to normal time-based techniques? Is perhaps that, when stored procedures and benchmark functions are disabled, is resorting to heavy queries the only way to perform a bit of vulnerability investigations?

2. With reference to MySQL, the fact it takes 30 seconds what does it mean? My reasoning is: if it takes 30 seconds so the injected query (heavy query) can be executed so since the query was tailored specifically for MySQL the database platform is MYSQL. But what about the negative result?

3. Am I right in saying that the heavy query approach is used only to retrieve information about the database platform? It's actually another way to get that kind of information. Other methods deal with Benchmark aand sleep function (MySQL).

Answer 1

I believe that the intent is to make the query take a long (measurable) period of time should the query be executed in one particular way, and as a result take a short period of time if it were executed another. This means that you can determine those parts of the query that was executed.

How you interpret that, however, depends on what your original query was, and what you have managed to SQL inject into it, and you are not limited to determing database platforms.

Using blind SQL injection you can turn the database in to a TRUE/FALSE machine where you can ask TRUE/FALSE question about anything stored and get an appropriate reply, and so you can slowly work out a great many things about the database.

Real life example I had an case of blind SQL injection that would take a long time (about 20 seconds) if some injected query were true, and would return immediately if false. So given the injection string:

value' and 'bob' = (select user from table)--

I can enumerate all the users of the system