I am trying to understand the concept of Boolean Based Blind SQL Injection. I have gone through OWASP Guide To SQLi to understand it. However I am confused with how exactly does it work. Below is what I understand from the article in the above link. Please let me know if my understanding is correct or if I am misunderstanding something.
So as per the link above, we assume a sample URL where the vulnerable parameter is 'id' as:
So the coreesponding query being executed on the server could be:
SELECT field1, field2, field3 FROM Users WHERE Id='$Id'
Now assuming that
Users contains a field named
Username, we want to extract the value of the
Username field where
id=1 using our boolean technique. So we try to guess this value character by character by doing this:
$Id=1' AND ASCII(SUBSTRING(username,1,1))=97 AND '1'='1
The article says that we keep increasing the ASCII value from 97 onwards 1 by 1 whenever we find the evaluation to be false.
Now the problem here is how to find whether the result that gets returned from the above query is
So to solve this problem, the article says that we try to perform the following before we try the above:
$Id=1' AND '1' = '2so this would generate the query
SELECT field1, field2, field3 FROM Users WHERE Id='1' AND '1' = '2'.
After the execution of the above query, the server would return certain status (a page, a redirection etc.). Now since
1=2 will always be evaluated to
FALSE, we would get to know what happens in the event of a
FALSE result returned from a query.
Now we can match this result with the result that we get by the execution of
$Id=1' AND ASCII(SUBSTRING(username,1,1))=97 AND '1'='1and thus conclude if the test against 97 (or any specific ASCII value) evaluates to
- Is my understanding of the above correct ?
- If yes, then in the query,
$Id=1' AND ASCII(SUBSTRING(username,1,1))=97 AND '1'='1, why do we need the part after the
AND? I mean, can't we confirm the result (as confirmed in the analysis above) without the bold pat of the query? Why is bold part of the query really needed?
- Since in this technique also we are basically trying to see the error page and distinguish it from the success page, should it not be considered as an error based SQLi rather than calling it boolean based?