SQLI Write-ups
1. Uber Blind SQLI
After subscribing to Uber in China, an advertisement was sent to the associated email account. The unsubscribe link in the email is different than the normal Uber unsubscribe link.
The URL parameter p contains a Base64 encoded JSON object seen below (with the added payload):
The original request would look like this:
By issuing the request with the " and sleep(12)=1" payload, the server sleeps for 12 seconds.
Orange Tsai wrote a payload to return the Username and Database of the Database where the Blind SQLI is occurring.
2. Starbucks
Researcher discovered Time Based Blind SQLi on the news.starbucks.com domain. The vulnerability exists on a HTTP POST request to the home path of the Starbucks domain in the group_id body parameter. The request with payload is illustrated below:
The request successfully delays the server response time.
The researcher also illustrates how to determine the database version through the following requests using curl:
You can see the response time for version 5 is greater than version 4 meaning the sleep command executed on the first request (version 5) proving the database version is 5.
Exploiting the vulnerability using SQLMap and retrieving the available databases and DBMS info as a PoC:
The researcher thankfully provided a detailed full write-up here https://timeofcheck.com/time-based-blind-sqli-on-news-starbucks-com/.
3. U.S. DoD (SQLMAP Exploiting Blind SQLi)
The URL https://redacted.com/dwr/exec/EndUserSvc.validateCageCode?callCount=1&c0-scriptName=EndUserSvc&c0-methodName=validateCageCode&c0-id=5096_1489967152565&c0-param0=string:1 contains a URL parameter c0-param that is vulnerable to Blind SQLi.
In the example below, the researcher uses SQLMap to exploit the vulnerability. On line 68 below, SQLMap displays the database type as a Proof of Concept.
4. QIWI SQLi Out of Band Interaction
Quoting the Researcher:
The API interface on https://contactws.contact-sys.com:3456/ accepts a
<REQUEST/>body to interact with the server's AppServ object. Because of insufficient input validation, an attacker can abuse theSCEN_IDparameter to inject arbitrary SQL statements into theWHEREclause of the underlying SQL statement. This leads to a blind SQL injection vulnerability, which in turn leads to Remote Code Execution on the server.
The unedited HTTP POST Request
The researcher makes use of Burp Suite's Collaborator which is a network service tool that can be used to detect out-of-band SQL injection. In short, this works by providing a unique subdomain which is used in the payload. Using the unique subdomain in the payload, the backend server reaches out to the Burp Collaborator server as it does a DNS lookup of the subdomain. There are other uses for the Burp Collaborator, such as out-of-band exfiltration, but this is enough of a PoC to prove that the server is vulnerable to Blind out-of-band SQLi.
Modifying the SCEN_ID body parameter to use xp_cmdshell and ping the Burp Suite Collaborator server with the unique subdomain generated (yhjbc2mndl88o89il3ueyud7zy5pte.burpcollaborator.net). This will make a DNS request to the burpcollaborator.net server with the unique subdomain.
Issuing the request will successfully cause the web server to do a DNS lookup of the domain. The server can be seen reaching out to Burp Suite's Collaborator with the unique subdomain (yhjbc2mndl88o89il3ueyud7zy5pte.burpcollaborator.net).
The researcher also used SQLMap to exploit this vulnerability and retrieve the database name. The sqlitest.txt file is the above HTTP POST request.
5. Cookie Parameter Blind SQLI
The lang cookie parameter was found to be vulnerable to SQLI. The request was sent with the following payload, and the server will delayed the response:
%2b(select*from(select(sleep(20)))a)%2b
6. LocalTapiola URL Parameter
The HTTP URL redId parameter on http://viestinta.lahitapiola.fi/webApp/cancel_iltakoulu?regId=478836614&locationId=464559674 is vulnerable to Blind SQLi. The researcher illustrates this through the use of SQLMap.
7. LocalTapiola URL Parameter 2
The following payload is URL encoded and submitted in the URL blobwhere parameter:
' AND 5851=DBMS_PIPE.RECEIVE_MESSAGE(1000,5) AND 'bar'='bar
Using Curl the researcher demonstrates the delay in response time of 5 seconds.
8. RocketChat URL Parameter
The new URL parameter was found to be vulnerable to Blind SQLI.
Payload:
Request:
9. Blind SQLi URL Path
The path gets filtered on the backend as a tag and upon retrieving the request it searches for the tag. The path https://betterscience.org/plugin/tag/ filters anything prepended to the URL path as a tag and displays the output. By issuing it a specifically crafted SQL request it is possible to trigger Blind SQLi.
Payload:
if(now()%3dsysdate()%2csleep(0)%2c0)/'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22
Request:
10. JSON Post Parameter
The researcher included a video PoC in his description as well https://www.youtube.com/watch?v=m5J7Rs4O3do&ab_channel=TheKonquerRor.
HTTP JSON POST parameter docid is vulnerable to Blind SQLi.
Quoting qonqi:
for a TRUE query we get - {"d":"3"} for a FALSE - {"d":""} for a Syntax error - {"Message":"There was an error processing the request.","StackTrace":"","ExceptionType":""}
so using this blind technique we can extract the data from Database
examples
docId:"1 and (select substring(@@version,1,1))='M'" - true docId:"1 and (select substring(@@version,2,1))='i'" - true docId:"1 and (select substring(@@version,3,1))='c'" - true
docId:"1 and (select substring(@@version,22,1))='2'" docId:"1 and (select substring(@@version,23,1))='0'" docId:"1 and (select substring(@@version,24,1))='0'" docId:"1 and (select substring(@@version,25,1))='8'"
and so on.. . So we have a MS SQL Server 2008
11. Tube8
Company summary:
Researcher found a blind SQL injection in the profile comment Like functionality, executing on the second request made for a given comment (dislikes).
URL and Payload:
https://www.tube8.com/ajax2/likeProfileComment/?profile_id=70418291&comment_id=291751-benchmark(1000000000,1-1)&hash=f42ffae0449536cfd0419826f3adf136
Issuing the request successfully delays the response.
12. Tube8 2
The topsort URL parameter on https://www.tube8.fr/ajax-hof/?toplimit=2&topsort=followers+or+sleep(0.000000001) is vulnerable to Blind SQLi.
The request below contains the payload in the URL parameter. The researcher stated that any larger value in the sleep function makes the application timeout, possibly due to the injection point being in a WHERE statement which is executing for every record in the table.
13. DoD URL Parameter
There is a HTTP GET URL parameter that is vulnerable to Blind SQL Injection at https://███/pubs/get_publications.php, pub_group_id is the parameter.
Payload below contains a 5 second delay in response in the pub_group_id parameter. Issuing the request successfully delays the response by 5 seconds.
The researcher used SQLMap to exploit the vulnerability. The test.txt file contains the above HTTP GET request (without the payload).
14. User-Agent HTTP Header
Researcher discovered the labs.data.gov website has a route /dashboard/datagov/csv_to_json that is vulnerable to Blind SQLi on the User-Agent HTTP Header.
Appending the following payload to the User-Agent Header delays the response time by 25 seconds:
'XOR(if(now()=sysdate(),sleep(5*5),0))OR'
The appended payload can be seen in the request below. Issuing the response below, the researcher successfully illustrated that the server takes 25 seconds to respond.
15. DoD URL Parameter
The doc_id URL Parameter on the /library.php route was found to be vulnerable to Blind SQLi. Issuing the request below makes the server delay it's response by 5 seconds. The payload 1 AND (SELECT * FROM (SELECT(SLEEP(1)))WUeh) is URL encoded and placed into the doc_id URL parameter.
16. DoD
Researcher discovered the countID URL parameter on the route https://www.xn--4zhaa/public/saveCount.cfm?countID=4 is vulnerable to Blind SQLi. Illustrated below, the researcher uses SQLMap to exploit the vulnerability and retrieve the banner for the database.
17. DoD
The route https://███/hro/html/tech.cfm?Sort=SLEEP(25)&ThisType=3 contains the URL parameter S Sort which is vulnerable to Blind SQLi. Issuing the request to the URL with the payload SLEEP(25) will delay the servers response by 25 seconds.
18. HTTP GET URL Parameter
Researcher discovered URL parameter that is vulnerable to Blind SQLi. The payload can be seen in the parameter.
https://windows10.hi-tech.mail.ru/api/tweets?city_id=(select(0)from(select(sleep(25)))v)
Request:
Response:
19. DoD POST Body Parameter
HTTP POST request rememail body parameter is vulnerable to Blind SQLi.
The researcher illustrates how to retrieve the database version through blind SQLi. This will either create a 2 second delay if true, if not the response will be immediate. This can used to iterate over each possible version number to detect which version is currently in use.
Incrementing the number before sleep:
20. OLX Body Parameter
The /ajax/buybundle/getbundle/ route contains a HTTP POST body parameter location that is vulnerable to Blind SQLi.
21. InnoGames
InnoGames URL Pathway was found vulnerable to Blind SQLi.
Extracting database info:
22. Zomato
HTTP POST Request body parameter res_id was found vulnerable to Blind SQLi, allowing the researcher to extract information from the database.
23. DoD
HTTP GET URL parameter t is vulnerable to Blind SQLi on http://www.█████████/viewVideo.asp?t=7.
24. InsideOk
Body parameter count vulnerable to Blind SQLi.
Last updated
Was this helpful?