So in a normal scenario, when you get an actual error, then you can shave Enescu all injection attack
and when you don't get an error, you can try Boolean technique's.
But there were other times that sometimes even this doesn't work.
So in this lesson, we're going to examine another school injection, OK, open school injection, blind
time-based.
So as in the previous lesson, you will see a simple search field, so let's try something to search.
And maybe a single quote could leak something, hmm, nothing.
So it seems that we always display the same page, same response.
Yeah, and we have nothing to determine whether our searches or payloads reach the database and execute.
OK, folks, open your terminals before going any further.
Them as Kuli underscore 15 dot BHP.
So online, 26.
Air reporting is turned off.
That explains why we don't get the errors.
And rigorous security checks, here they come.
So this part is important to us here, the actual query is just like this.
It's not any different to the previous query that we see in boolean based escarole injection.
Then this query execute.
And if there's no error and the ResultSet is not empty, then it does something.
Actually, it sends an email to the user's address.
So scroll down a little bit.
Now, this is a search box.
There is no code that can affect the page here.
So go back.
OK, I forgot to try boolean values.
So type or one equals one.
Nothing happens.
At a harsh character.
No, nothing.
All right, change one to two and try.
Nothing happens yet, I'm I'm the one who's supposed to know what he's doing right now, what I'm showing
you here is you can tell the comparing with boolean operators doesn't necessarily work all the time.
So that means that we need to use time based escarole payloads, which is what I guess I began telling
you.
But I want you to see when you need to use.
So now let's have a look at this payload.
Now, focus on the end statement.
So if the whole query is legitimate, the left side of the and will execute very quickly and the right
side of the end will sleep for two seconds and then execute.
So we're going to observe the page for the response.
If the page loads approximately after two seconds, then it means we get an actual injection, so quick
search.
And look at the left lower corner browsers waiting for the page.
Now, I forgot to count for two seconds, but you can see it works.
And then you can shape the payload to pull data.
But I'm going to show you some other types of payloads as well, so let's have a look at this one.
Oh, no, no, wait, wait, wait.
You can also use this, the benchmark function.
So there's several payloads with Benchmark's.
And now we can perform the version detection.
So use this payload.
And if the first character of the version is five, it will sleep for two seconds.
Yes, so it waits so you can get all one by one.
And then right this payload to get the first character of the current database.
The page will load after two seconds of its B.
And yes, it is B.
OK, so try this one to get the length of the current database up, no, wait, wait, then change it
here to five and search.
And yes, it has five characters, so to learn the length, you can also use the like operator with
placeholders.
So let's add one more placeholder.
Yeah, it works.
OK, so I think I think you get the point now.
Yeah.
Now, I, of course, have several other payloads, but they do pretty much the same things.
So I'm going to share all that with you in a separate file, and I'm going to stop at this point and
you can try some of the other payloads on your own, go for broke, see what you can do.