6

Firstly, from what I have read so far, boolean-based blind SQL injection is when you can't see any error messages and rely on true or false responses to queries to milk the database. For example, you can craft a query that will ask the database whether the the first character of the table schema name is an "E" or whatever. And you can keep asking until you have the database name, table name and column names to dump the information you want.

I understand that there is also time-based blind SQL injection, but I'm not concerned about that.

Secondly, I have seen many articles & YouTube videos saying that what they are showing is a blind SQL injection (because no error messages are shown). However, they are still able to use UNION SELECT queries to pull information out from the database. For example, id=1' UNION SELECT 1,2,3,table_name from information_schema.tables. Doesn't this count as UNION-based SQL injection? If not, what is this called?

By rights a pure blind SQL injection doesn't allow you to use UNION statements. Am I right? Is there anything wrong with my understanding?

Improve this question
1
  • 1
    This is why I try to avoid youtube tutorials and read books where topics do not get mixed.
    – k1308517
    Apr 14, 2016 at 8:31

2 Answers 2

Reset to default
6

Most of what you say is correct.

The UNION statement in regard to SQL injection is just another way to attempt to break/change/extract data. It can be blind, partially blind, or not blind at all, this depends on the server, code, and error reporting.

If the injection doesn't output any data, but does effect the behavior of the site in a way that you can interpret as having done something different than normal, it is considered partially blind.

If the injection doesn't output any data, and there is no change in behavior of the site at all, this is considered totally blind.

Using UNION may or may not change the outcome, but isn't inherently linked to being blind or not.

Improve this answer
1
  • So example if a website is changes its look upon a ' inserted but no error msg is displayed and I used union to dump the information. It is a partially blind sql injection?
    – ysj
    Jun 8, 2013 at 14:11
2

UNION SELECT based SQL injection is not considered blind, and neither is error-based SQL injection. So the videos you found are indeed incorrect in their descriptions.

It is blind if you cannot directly see rows from the database output into the page. With UNION SELECT SQL injection, parts of the page will contain data from tables and columns that were not intended to be included by the original coder. And with error-based you get the same, just it's in the output of error messages.

Blind SQL injection means none of the rows in the database are directly disclosed onto the page. Examples typically include if you find SQL injection inside of an INSERT or DELETE statement, or inside a SELECT statement that immediately throws away, or otherwise does not output, the data it retrieves.

For example, if you had some login code that looked like query("SELECT username FROM users WHERE username='$username' AND password='$password'");, where either $username or $password are injectable, odds are the result of this query won't actually be output anywhere. It is simply a "check", not a retrieval. In this case your only option is to use blind injection. In a case like this, you could use blind injection to read data from any table, or you could use it to login without knowing the password. Blind injection is not always limited to extracting data from the database, it can also include making actions that the author did not intend by abusing the results of SQL queries.

Blind injection is split into two kinds: boolean blind and time-based blind. Sometimes boolean blind is called "partial blind" and time-based is called "full blind" but I find those to be kind of unclear.

Boolean injections are the easier one to exploit, but may not be found in all cases. All blind SQL injections (really, all SQL injections anywhere) will be vulnerable to time-based blind injection as long as the database application has some kind of function or feature that can delay the response for at least a second or two. Most big databases do have such functions. The disadvantage is that it may take a long time to extract large amounts of data.

I'll leave you to research exactly how those blind injections work, but your description of boolean blind injection is correct.

Improve this answer
2
  • 2
    I prefer to use union select statements to access other tables in my blind sql injection exploits. This post is misleading.
    – rook
    Jun 9, 2013 at 22:06
  • 1
    @Rook Could you give an example? I'm pretty sure 100% of the time that one could use UNION SELECT inside a blind SQL injection, you could just use a SELECT subquery (which will be more versatile anyway, since it'll work when the statement you're injecting into doesn't begin with SELECT). UNION SELECT only has to be, or should be, used with non-blind SQL injection.
    – Anorov
    Jun 10, 2013 at 3:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .