Blind SQLI
Blind SQLI is like the database version of the childhood game hot or cold. If you've never played it, the kid who hid the toy provides hints to the searcher by saying hot with varying levels of enthusiasm as the searcher gets closer, and cold when they are trending away from the hidden objective. So it goes with Blind SQLI: when a database won't just spell it out for you, and the application developer is hiding error details, you can sometimes get all of your information by inferring the answers and asking the right true or false questions. Sure, it will be easier to obtain the data outright via one of the classic SQLI modes but, by using queries as a sort of true/false probe, hackers can systematically enumerate a database without ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access