+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Blind SQL injection help (/showthread.php?tid=6041419)
Blind SQL injection help - wattseat - Jan 15, 2020
Hi
I'm putting some effort on getting access to username and password of an .aspx page.
I've been trying blind sql injection since the page isn't amenable to classic injection.
My question is: Am I still able to perform a blind sql attack if the page responds to true statements by not loading (progress bar just keeps spinning)? If a false statement is inserted, for instance id=1 and 1=2, the page produces a custom error.
Any help is appreciated
Thanks.
RE: Blind SQL injection help - ropslide - Jan 15, 2020
Quote:Am I still able to perform a blind sql attack if the page responds to true statements by not loading (progress bar just keeps spinning)?
Definetly. That is the point of a blind SQL injection.
RE: Blind SQL injection help - wattseat - Jan 15, 2020
I have almost no experience, except what i've been reading and trying over the last like 36 hours.
sqlmap couldn't find ejection points (assuming I did everything right), and every page I looked into explaining how to perform the process manually, assumes that true statements are going to follow through and are based on a delay command for verification. But in my case, the page just won't load, and I can't seem to find a compreensive tutorial for m situation.
RE: Blind SQL injection help - Tyr - Jan 15, 2020
(Jan 15, 2020 09:10 PM)wattseat Wrote: I have almost no experience, except what i've been reading and trying over the last like 36 hours.
sqlmap couldn't find ejection points (assuming I did everything right), and every page I looked into explaining how to perform the process manually, assumes that true statements are going to follow through and are based on a delay command for verification. But in my case, the page just won't load, and I can't seem to find a compreensive tutorial for m situation.
Don't rely too much on SQLmap. Always scan, then if this fails, manually look for a vuln. If you do not know how to find vulns manually, send me a PM. Also, it's injection* haha.
RE: Blind SQL injection help - Teferi - Jan 16, 2020
You can get the respsonse time with python using the total_seconds method:
Code
response = requests.post(url, data=post_fields, timeout=timeout)
print(response.elapsed.total_seconds())You say it keeps loading, maybe you can write your own program to dump the database and use the total_seconds method to see if it's either TRUE or FALSE.
RE: Blind SQL injection help - Kitty - May 5, 2020
I've encountered a problem with blind inj. cause the results that come up with the ascii table are one letter before the actual letter but I can't get the final results out.
For example I get "fqnto_hc" instead of group_id or "oarrvnqc" instead of password.. -_- Could someone please check what's happening, thanks !!
RE: Blind SQL injection help - sinclairKali - May 7, 2024
why is blind sql injection so hard?