11

I understand what a time-based SQL injection is, and I understand how it works (at least how it's detected/exploited).

However, is there anything in specific which makes this type of injection any different to say boolean-based blind injection?

What I'm saying is if you take the following code:

<?php
$x = 'admin" AND SLEEP(10)#';
$y = 'superSecretPassword';
$query = sprintf('SELECT * FROM users WHERE username="%s" AND password="%s"', $x, $y);
echo $query;
?>

which results in the following output:

SELECT * FROM users WHERE username="admin" AND SLEEP(10)#" AND password="superSecretPassword"

That is vulnerable to almost every form of SQLi.

I guess my questions are:

a) Why would you chose to perform a time-based SQL injection over any other method of injection as Time-Based takes so long and is arguably more detectable than other methods?

b) (Running SQLMap or similar tools in this case) How is it that other methods fail, but time-based SQL injection is present?

Improve this question

1 Answer 1

Reset to default
11

It is not different in value from "regular" Blind SQL Injection, it's just different in manner of exploit.

The only real reason for going time-based (other than learning, of course), is if the other types of SQLi are not available. Same reason you would bother with "regular" Blind SQLi, instead of regular SQLi.

"Regular" blind SQLi is dependant on getting back some value, even if it is only one bit different. It is easy to imagine a scenario where ZERO bits leak out directly, e.g. an application that scrubs the response, returns a single static response no matter what occurs in the database.

In such a situation, Blind SQLi would not help. So, you are forced to get back that single bit of information in other ways - i.e. time delay. Now, the rest of the Blind SQLi techniques can step in, based on this one indirect bit of information.

So to answer your direct questions in reverse order:

b) How is it that other methods fail, but Time-Based SQLi is present?

Because the application does not return even a single bit of information directly, even though it is injectable.

a) Why would you chose to perform a Time-Based SQLi over any other method of injection as Time-Based takes so long and is arguably more detectible than other methods?

Because (b).

Improve this answer
3
  • Okay well that clears a lot of indirections up! Thanks man! Much appreciated
    – DarkMantis
    Oct 23, 2013 at 14:19
  • 1
    @AviD♦ - really interesting answer; it made me realise two things: 1) that the concept is simple, but 2) that the real trick is in how we actually approach the problem. Very elegant answer; thank you: +1.
    – Lex
    Oct 24, 2013 at 13:38
  • @Lex It IS simple, once you understand Blind SQLi - it's just a different way of getting back that one bit of Boolean info. Another way is Ping-based SQLi...
    – AviD ♦
    Oct 24, 2013 at 20:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .