SQL Injection - Lab #11 Blind SQL injection with conditional responses

In this video, we cover Lab #11 in the SQL injection track of the Web Security Academy. This lab contains a blind SQL injection vulnerability. To solve the lab, we perform a blind based SQL injection attack on the database that retrieves the password of the administrator user on the application.

▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬

▬ Contents of this video ▬▬▬▬▬▬▬▬▬▬
00:00​​​ - Introduction
00:58 - Understand the exercise and make notes about what is required to solve it
03:10 - Exploit the lab manually
31:55​ - Script the exploit
48:17 - Summary
48:39​ - Thank You

▬ Links ▬▬▬▬▬▬▬▬▬▬

[pablofalco]

I've been doing one course after the other, no one explains explains things like you do. Fantastic job! Thank you.

[mih]

I thought I was afraid of spiders, long lines at Disney and Jury Duty.
I was wrong, I'm afraid of Burp Community Edition.

Python script is life saver, thank you!

[camelotenglishtuition]

100% the best online series that I've ever seen. Well-paced, well explained. Just outstanding. Thank you!

[bouzrouraramzi]

thanks for all your effort its really rare to find such a good content in the security field keep going

[HerbertEduardoFernandezTamayo]

Awesome video, in case anyone has issues dealing with SSL Version Error, I switch off the proxy during the request, like this: r = requests.get(url, cookies=cookies, verify=False), after that I got the password, in my system (intel i3, no gpu) It tooks 13 minutes. Thanks a lot Rana

[karthikbt]

You're an amazing teacher! Can't believe this content is free. Thank you for your efforts 🙏

[igododevcode]

You are really good at what you do. You are such a great instructor

[psychology]

WOW, BEST TEACHER EVER KEEPS GOING TEACH US TO KEEP THE WORLD CLEAN AND SECURE!,

[josimartaf]

Just passing by to say Thank you, Teacher,
I m learning a lot with you.
Greetings from Brazil.

[williambonneau]

very quality video thanks a lot. for those who want to optimise the python script, you can compare to ascii the index of password in database with your enumeration, (compare with ">") you will have less iteration, 30second nedded to find the password. if you want more you can use multithreading, with 16 threads it's take approximately 2 second

[Mdicin_mAn]

Great content! Just purchased your course. Thank you for all the amazing effort and work. I am a bootcamp student and this is bringing up my skills greatly.

[mandulatula]

Thank You Teacher. Explanation to each statement is brilliant👏

[Harini.R]

Was just searching for this one and here it is! Eager to watch this :)

[abdoulsalamamoumoune]

Ma Sha Allah! thanks again for this useful and instructive work

[VulnifyLabs]

like always your introducing was great my best teacher!!!

[rddg]

Excellent video!
I really enjoyed the scripting portion.
I just ended up running multiple cluster bomb attacks and stopping when the requests got throttled. Then I’d shorten the brute force character list by removing the letters that had already been tried. 🤣

[aceabbott]

You very much earned my subscription. Thank you for the explanations.

[kusharora]

what an effort and so very well explained.. ! thank you so much!!

[damianhamilton]

ahh this is the best one yet! great stuff, keep up the hard work

[olusegunadejorin]

You are wonderful at what you do, kudos for all you do