[Tutorial] Using LOAD_FILE with Time Based MySQL Injection [HQ!]

Today I'm going to be going over using LOAD_FILE with Time Based Blind SQL Injection. This method may look advanced, but if you take a look at my tutorials bit by bit the pieces will come together.

First off, Time Based Blind MySQL injection is a painful method, and very time consuming. However, if you're running out of options, this may be a chance to further exploit your vulnerable website.
Now first off, time based should only be used when there is NO other option available. Blind MySQL injection is slow enough, but TIME BASED...even worse.

Now skipping all the other options using MySQL Injection (digging for login info, into outfile, etc), we're going to jump into LOAD_FILE to get the tutorial started.

LOAD_FILE does what it sounds like, loads a file. Ex: on linux. Here's an example of a UNION based attack using LOAD_FILE.

Spoiler (Click to View)

If magic_quotes_gpc = On, then convert your file name to HEX.

Spoiler (Click to View)

Using TIME BASED attack:

Spoiler (Click to View)

Now my page takes 3 seconds to load, this confirms I can use a time based attack.

Now in order to use LOAD_FILE, you need file permissions. Here's an example of how to check if the MySQL user you're running has proper privileges.

Spoiler (Click to View)

If magic_quotes_gpc = On, convert to HEX.

Spoiler (Click to View)

Now my site takes an extra 3 seconds to load, which means the query returned a true value, meaning I have file privileges.

Now that we know I can use LOAD_FILE, let's get some FPD (Full Path Disclosure) to get the full website path (which we will use to guess configuration files).
Let's try converting our parameter to an array, in order the force a PHP error.

Spoiler (Click to View)

Now that we got the full site path, we're going to be using a function in SQL known as ISNULL(), to check whether the file we're looking for exists.
As most programmers know, ! is a sign for NOT, so !isnull is the same is NOT null. First, let's try using a known file. Let's take a look at our HTML source.

Spoiler (Click to View)

Take a look at the HREF attribute, which specifies a destination link. It's referring to a file called "index.css". Now let's combine this with our full path, and check if the file exists using !isnull.

Spoiler (Click to View)

If magic_quotes_gpc = On

Spoiler (Click to View)

Success! Our page took an extra 3 seconds to send the request, meaning our file we're attempting to load is NOT NULL (meaning it exists).
Now that we know how to check if files exist, let's try digging up some MySQL configuration files 😏

Here's a few common configuration file names.

Code 
connect.php

mysql.php

config.inc.php

config.php

Now this is my local server, I know the configuration file name. So to save time, let's try guessing one that DOES NOT exist, then one that EXISTS.

Spoiler (Click to View)

If magic_quotes_gpc = On

Spoiler (Click to View)

The page loads instantly, meaning our query returned false, and the file we're trying to load is NULL (does not exist).

Now, let's try guessing the config file name (in this case, config.php).

Spoiler (Click to View)

If magic_quotes_gpc = On

Spoiler (Click to View)

Our page takes 3 seconds to send the request, meaning the file we're loading (config.php) EXISTS!!

Now let's try pulling some data from it. As you may know, most PHP files start with "<?php". Let's try seeing if this is true using a combination of a TIME BASED attack, SUBSTRING, and LOAD_FILE.

Spoiler (Click to View)

If magic_quotes_gpc = On

Spoiler (Click to View)

The page takes 3 seconds to send the request, meaning this query returns true. This says that the first 5 characters in config.php are '<?php'

Now we can dig up some of that login info using Blind MySQL injection. I hope you guys learned something new, enjoy!

Resources:

Time Based Blind SQLi using SLEEP()
[Detailed] Boolean Based Blind Injection [Tutorial]
[Behind The Scenes] Boolean Based Blind Injection (Blind SQLi)
Mega Webhacking Tutorials By Me
✌