Blind sql Injection. (time delay)

For educational purposes only!
Hellow, HF users.
Since no one took the time and effort to make a decent time delay tutorial I'm doing it.
First of all what do you need.

A vulnerable only to blind sql injection .asp webstite.
Notepad, to store data you collect while injecting.
And loads of loads of spare time.

Finding vulnerable sites: --Kobez expanding vulnerable collection guide!--

The 2 kinds of time delay injection.

Integer injection:
So this line sais that satabase has to wait for 10 seconds before he responds.

If the database returns directly, we know its false.
If it waits 10 seconds its "true" obvious.

String injection:
same thing here only the quote came whit it ' as in basic sqli when u have a string injection.

Extracting the database username.

Wel. we have alot of work to do.
we need to find all characters. lets start whit one:
Lets explain first. we ask: if (len(user)=1) so we ask is user has one character. waitfor delay '00:00:10'
database needs to wait 10 seconds to respond. but we all know in most cases a user is not 1 char.

we will encrease (len(user)=1) to (len(user)=2) and so on and so on.


we have a hit. database just told us by waiting 10 seconds that user has 4 characters.
But what are the characters we seek? :/

Get characters whit ascii and time delay.
As we have seen in my previous tutorial. we are going to use ascii.
these will help us get the characters of the username.

97 in ascii is the letter A we will encrease this count untill we get a hit.
for example 97 A, 98 B, 99 C, and so on.

how do we do this.

what did i just say.
if ascii (character code) from user
1,1 (this means 1rst character) is 97 which is an A in ascii is correct. the database would wait 10 seconds befor ethe page loads.

We need 4 character so the 1,1 needs to be encreased. if we want the second character we need to do 2,1.

first character:

the first character is a E. how do i know this:
at 97 i had no delay which means its not an A
at 98 i had none either
not at 99, not at 100
but i did have a 10 second delay at 101. and 101 is E in achii char code.

We need 4 more characters.

second character is a C
look closely at what changed at the code. instead of 1,1 it is 2,1 because i wanted to know the second character of user.

Third character:

Third is an F yet again watch the code i changed 2,1 in 3,1.

fourth

fourth character is yet again an F.

we now have the four characters i needed:
ECFF = user.

What a hell of a job for 4 characters...
No, no we are not finished yet.

Extracting the db name.
Same as before database wants us to have a hell of a job, its a bitch.
now lets hope that god damn administrator likes short names (THEY DONT)

we need to know how many characters the db name hase. not much difference.
i said database: does db_name have only one character? database said no my admin hates that.
so we need to run down the whole thing again. changing the =1 into =2, =3 and so on.
untill he waites 10 seconds.

our db name has 3 characters (in real cases they will probebly end up in 8 or 10 characters.
but this is a tutorial. i wont type a milion characters. if you did not get it by now XD sorry for you.

first character.

first character is C


second character is an E watch the limit again 1,1 changed to 2,1.


last letter is another E
db_name = CEE

Extracting database tables
the principal remains the same.
IT IS EASY. but if you want to go out door once in a while.
avoid blind sqli..

we need to know how mutch characters it hase ans we need to know what characters it has.
by now you should know the drill.

This one has 5 characters.

we need to know the characters.


Table name is USERS.

Extracting table column names.

how many characters does this column have. we know how it works ppl.
ok here we say we select the column name from database (thats the name we had at start DB_NAME) this one is CEE. we select this out of the table users we had above this part.
It has 8 characters.

now we need the characters to create the name.

column name is username.

Now we need to extract the others. in some cases you could have up to 10.
lets say i only have 2 username and pass to keep it easy.

the second column name hase 4 characters.

the charracters:

so we now have the column pass.

looks like we finally get somewhere.
we have column username and pass! yay.
but not yet there not yet.

Extracting rows from columns.

extracting from column username.

count of characters: 5
what do we do here? we select whats in the column username from table users.

we need to extract the characters now:

We now have the name admin. (the one we need.)

extracting from column pass.


we need to extract the characters now:

pass= effec

Now we have username: admin and his pass effec.

have fun, see ya in about an houre or 5 when you finish :D
Sorry for the bad english!
and i hope you enjoyed my tutorial. grtz real steel!