Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

"Lab: Blind SQL injection with conditional responses" syntax question

Lucas | Last updated: Aug 25, 2022 06:41AM UTC

The following are given as examples about how to test for truth: TrackingId=xyz' AND (SELECT 'a' FROM users LIMIT 1)='a TrackingId=xyz' AND (SELECT 'a' FROM users WHERE username='administrator')='a TrackingId=xyz' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)>1)='a I've looked around and asked questions about this, but I'm still not sure I understand. How is the string 'a' being returned within the parentheses? This essentially becomes 'a' = 'a' from what I understand. So if whatever is after SELECT 'some string' is true/exists, then whatever string you entered is returned? Is this some strange phenomena of SQL? Or is there the string 'a' somewhere in the data set behind the scenes?

Lucas | Last updated: Aug 25, 2022 06:50AM UTC