SQL Injection - Lab #14 Blind SQL injection with time delays and information retrieval

In this video, we cover Lab #14 in the SQL injection track of the Web Security Academy. This lab contains a blind SQL injection vulnerability. To solve the lab, we exploit the time-based SQL injection vulnerability and output the password of the administrator user.

▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬

▬ Links ▬▬▬▬▬▬▬▬▬▬

[Bixsu-]

Thanks for these videos! As a complete beginner I didn't quite understand how a SQL command is executed step by step, your explanations provide some insight that the Web Academy doesn't.

[Vinayak-qp]

amazing, this could be probably one of the biggest information that i have ever been given. we need such playlist more and more in upcoming days. we need all portswigger lab solution.

[golamrabbani..]

Very nice and I am very excitedto see your videos

[milosmarkovic]

If anyone is using MAC and struggling to find the 'Columns' tab while filtering results from the attack, don't forget to look at the very top of your screen, it's not like on the video, don't be like me, and look everywhere in the Burp :')

[carloa]

Hi, thank you so much for your videos!
Can you make a short video (or explaination) how to use/compile your Py code? (in case we are using burpsuite borwser, is it different?). Thank you again! :D

[LeChaser]

Hi Rana! Just wanted to thank you for the awesome vid and great explanation!

Do you have a payload list that you use to id these vulns in the wild, or do you go from your knowledge on what would work and whatnot?

[camtap]

Hey Rana,
First I want to say I love your videos. They are very helpful and the explanations really help me understand the material.

I have encountered a problem with Lab 13 and 14. I follow your steps and even double check the query syntax from the given solution from Port Swigger. I am able to enumerate the password, however, every password I get is wrong. Any idea what could cause this?

Thank you so much!

[ahmedsaleem]

you can also use the following payload to confirm if administrator user exists.
|| (Select pg_sleep(10) from users where username ='administrator')--

[DuulHomes]

Doesn't it always automatically url encode? I found no need of doing it!

[Coollinux-cb]

i dont understand yet like does "||" working like query "AND" and "OR"?, please help me

[HawkRage]

Can we use the previous lab script on this one

[odesconhecido]

i have a question. How i confirm that param is vuln? i go and test some payloads on param randomly?

[webtzr]

Can you make tutorials on what you have learn from OSCP.plz...

[abdulx]

I have only one problem How can I learn the SQL command query: BY the way My Web security progress is going to be very awesome 😊

[TriNguyen-dluu]

hi, I'm having a problem cracking the password with a slightly different query that I believed is correct:' || (select case when (1=1) then pg_sleep(3) else pg_sleep(0) end from users where username='administrator' and substring(password, 1, 1) = 'a' --. When I use intruder in burp, for some reason it didn't work. Could you please take a look and give me some feedback?

[nikhilbartake]

Hi I have a question, How do i carry out the end attack without resource pool. Do I mess with the request engine settings?