Hands-On Application Penetration Testing with Burp Suite

Intruder detection

Detecting SQL injections using a manual request is also an option. I recommend that you perform it when you are reviewing an application without a successful vulnerability detection.

First, we detect the entry points, as we reviewed in the previous section. To detect vulnerable points related to Blind SQL injection, you can use the following testing string:

' waitfor delay '0:0:30'—

We can also use its counterpart in the DBMS. But why should we do that? Well, as you may remember, the most important characteristic in Blind SQL injections is that they do not return errors or outputs directly to the user. So, by using this string, we are waiting to see the delay in the response:

1. To cover more parameters, we need the Intruder ...