Time-based blind SQL injection

Some web pages are written in a way in which no data is actually presented on a web page, including errors and database data. In this case, we need to exploit the MySQL if() and substring() functions to perform true or false operations. We can use these functions with the sleep() MySQL function and check the response time from the server for each query. If we creatively tell the server to sleep() on returning true, we know that our query was successful. This is time-based blind SQL injection in its simplest form. This method might not always be the most reliable one in some circumstances, since the returned result relies on a lot of moving parts, which could throw off the reading of time, such as the network, server ...

Get Penetration Testing with Perl now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.