SQL Injection - Lab #14 Blind SQL injection with time delays and information retrieval

In this video, we cover Lab #14 in the SQL injection track of the Web Security Academy. This lab contains a blind SQL injection vulnerability. To solve the lab, we exploit the time-based SQL injection vulnerability and output the password of the administrator user.

▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬

▬ Contents of this video ▬▬▬▬▬▬▬▬▬▬
00:00​​​ - Introduction
00:55 - Understand the exercise and make notes about what is required to solve it
03:41 - Exploit the lab manually
21:04​ - Script the exploit
35:22 - Summary
35:38 - Thank You

▬ Links ▬▬▬▬▬▬▬▬▬▬

[HerbertEduardoFernandezTamayo]

thanks a lot for the walkthrough, the entire series has been a blast!, I admire you: working until 2:30 am in the morning is just for experts!, amazing, seriously

[abbassadeghi]

tnx a lot professor
i have one question
when we use substr and when we use substring function
in latest Labs somewhere we used substring like this example:
' and (select substring(password, 1, 1) from users where
and somewhere we used substr like this example:
' || (select CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM users where username='administrator' and substr(password, 1, 1)='a') || '

[arenzovich]

Amazing work and tutorial series. Keep up the good work Rana.

Just a quick point, for efficiency - at intrusion part - we could just check if length of password is = to the payload (in this case numbers 1~25) instead of > . This way only the exact length (20) will take 10sec. ...LENGTH(password)=§1§...

[NetDevsRyan]

I tried over and over again, and downloaded this Python script and used it, changed the TrackingId and session and URL to match my fresh session, and was not able to get this to work. the Python Script runs, but never retrieves a result. It just continues to cycle through the ASCII characters. I'm on Python 3.11.6 on OSX 14 Sonoma.

[petergentile]

thanks for all these tutorials, and scripting them

[abemendez]

Hello Rana, great stuff. Learnt alot about SQLi. I would like to see more videos on how to go about writing python scripts. Thanks.

[jawahiral-jabarty]

Thank you soooo much, you are a great and honest teacher. Regards

[hilalkhan]

If a web have no tracking is it mean that the web is not vulnerable to the blind sqli?

[hoangnguyenthai]

Thank you for the lesson, I have a question is it possible to find the table name by time delays and how to do it?

[fammilogga]

Any reason to use such a long sleep timer instead of using 2-3 seconds?

[TheMsterDoctor]

i dont know why but the python code dont work !!!

[NassimDhaher]

Great python codes. This one gave false positives. I had to rerun the script several times since I was getting non-alphanumeric characters.

[vandanbhuva]

Is there a way to get the trackingid and session cookies using the script itself rather than having to add it manually? I tried using the r.cookies.get_dict() method but the cookies don't match with the ones opened in the lab probably because I'm sending another request to get the cookies.