Chapter 5. Blind SQL Injection Exploitation

Solutions in this chapter:

▪ Finding and Confirming Blind SQL Injection
▪ Using Time-Based Techniques
▪ Using Response-Based Techniques
▪ Using Alternative Channels
▪ Automating Blind SQL Injection Exploitation
Summary
Solutions Fast Track
Frequently Asked Questions

Introduction

So, you've found an SQL injection point, but the application gives you only a generic error page. Or perhaps it gives you the page as normal, but there is a small difference in what you get back, visible or not. These are examples of blind SQL injection, where you exploit without any of the useful error messages or feedback that you may be used to, as you saw in Chapter 4. Don't worry; you can still reliably exploit SQL injection even ...

Get SQL Injection Attacks and Defense now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.