2

I came along this blind SQL injection time based payload and I need to understand how it works

(select(0)from(select(sleep(0)))v)/*'+(select(0)from(select(sleep(12)))v)+'"+(select(0)from(select(sleep(0)))v)+"*/
1
  • Depending on the context it's used in, the /* may be within a quoted string.
    – paj28
    Commented Sep 25, 2014 at 16:37

1 Answer 1

4

MySQL uses /* */ as a block comment and no code will be executed within this block. What you are looking at is three injections, and only one will execute depending on the query that is augmented with this SQL injection attack. This is an efficiency hack to speed up the process of fuzzing a website for SQL Injection.

If the injection point doesn't use quote marks, then the first sleep payload will execute and comment out the rest of the injection:

(select(0)from(select(sleep(0)))v)/*

if the injection point is using single quote, then the 2nd payload will execute:

'+(select(0)from(select(sleep(12)))v)+'

Finally, if the query is using double quotes, then the 3rd and final payload will execute:

"+(select(0)from(select(sleep(0)))v)+"*/

Aren't compounded injections neat?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .