🛡️ Understanding and Exploiting Blind SQL Injection

📚 Table of Contents

• 🔍 What is SQL Injection?
• 🕶️ What is Blind SQL Injection?
• 🤔 Why is it Called "Blind"?
• 💣 Exploitation Technique: Conditional Responses
  • 🍪 Example Scenario
  • ⚙️ How It Works Step-by-Step
  • 🔓 Practical Example: Extracting a Password Character by Character
• 🛡️ How to Prevent Blind SQL Injection
• 📚 Additional Resources

🔍 What is SQL Injection?

SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. This can lead to unauthorized access to data, deletion of data, or even full compromise of the database server.

🕶️ What is Blind SQL Injection?

Blind SQL Injection is a type of SQL Injection where the attacker does not see the results of their injected queries directly in the application's response. Unlike regular SQL injection, there's no visible output or error message — hence the term "blind."

However, attackers can still infer information based on how the application behaves — for example, differences in response times or content.

🤯 Why is it Called "Blind"?

In traditional SQL injection, you see the output of your injected query directly. But in blind SQL injection:

• ❌ No error messages are shown.
• ❌ Query results are not returned to the user.
• ✅ The application may behave differently depending on whether a condition is true or false.

So, like being blindfolded, you're guessing what's happening behind the scenes — but clever techniques let you "see" through logic or timing responses.

💣 Exploitation Technique: Conditional Responses

Attackers exploit blind SQL injection by triggering different behaviors in the application based on true/false conditions in SQL queries.

🍪 Example Scenario

An application uses a tracking cookie:

Cookie: TrackingId=u5YD3PapBcR4lN3e7Tj4

The backend runs a SQL query like:

SELECT TrackingId FROM TrackedUsers WHERE TrackingId = 'u5YD3PapBcR4lN3e7Tj4'

If the ID exists, the app responds with:

👋 Welcome back

This behavior allows us to inject conditions and observe if the welcome message appears.

⚙️ How It Works Step-by-Step

Let’s test if a condition is true using injected logic:

1. Inject a condition that evaluates to true:

   xyz' AND '1'='1

➤ If the message "Welcome back" appears → condition is true

1. Inject a condition that evaluates to false:

   xyz' AND '1'='2

➤ If the message doesn’t appear → condition is false

By observing these responses, we can ask yes/no questions to extract sensitive data one bit at a time.

🔓 Practical Example: Extracting a Password Character by Character

Assume there’s a table Users with columns Username and Password. We want to find the password for the user 'Administrator'.

We use the SQL function SUBSTRING() to extract characters one at a time:

Step 1: Test first character > 'm'

xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) > 'm

→ 🟢 "Welcome back" appears → First character > m

Step 2: Test first character > 't'

xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) > 't

→ 🔴 "Welcome back" does not appear → First character ≤ t

Step 3: Narrow down to exact letter

Eventually, this confirms the first character is 's':

xyz' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) = 's

→ 🟢 "Welcome back" appears → Character confirmed as s

🔁 Repeat this process to extract each character of the password.

📝 Note: Some databases use SUBSTR() instead of SUBSTRING(). Always check the SQL dialect.

📚 Additional Resources

• OWASP SQL Injection
• PortSwigger SQL Injection Cheat Sheet
• Blind SQL Injection Explained (Video)

🔒 Stay secure, and remember: never test vulnerabilities on systems without explicit permission!