Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

[webacademy] Bug in explanation of blind SQLi

Lukasz | Last updated: Jan 25, 2020 05:14PM UTC

There is a bug in section 'Exploiting blind SQL injection by triggering conditional responses', page https://portswigger.net/web-security/sql-injection/blind. Initial query is SELECT TrackingId FROM TrackedUsers WHERE TrackingId = 'u5YD3PapBcR4lN3e7Tj4' always return a row. Then when we use UNION SELECT we just add additional row to the result. So it is not true that these queries return true (the first one) or false (the second one): xyz' UNION SELECT 'a' WHERE 1=1-- xyz' UNION SELECT 'a' WHERE 1=2-- Both of them make the final query to return true. To use it that way we need to make sure that initial query will return false. Then injection should looks like this: ' and 1=0 UNION SELECT 'a' WHERE 1=1-- ' and 1=0 UNION SELECT 'a' WHERE 1=2--

Burp User | Last updated: Jan 25, 2020 06:06PM UTC

I found the same bug today. First I tried to solve the lab by myself, but I had to take a look to solution and I realized that I was doing everything right. Reported the problem too. Will wait for an answer...

Uthman, PortSwigger Agent | Last updated: Jan 27, 2020 09:54AM UTC

Are you replacing the TrackingID cookie value item with "xyz' UNION SELECT 'a' WHERE 1=1--" or appending to the existing TrackingID in the example?

Burp User | Last updated: Jan 28, 2020 06:41PM UTC

You should make sure that first part of the query return no result so you need to add: ' and 1=0 Then, you can proceed with query you want to UNION, so: UNION SELECT 'a' WHERE 1=1-- #this returns one row - TRUE UNION SELECT 'a' WHERE 1=2-- #this returns no row - FALSE The whole query should looks like this: SELECT TrackingId FROM TrackedUsers WHERE TrackingId = 'u5YD3PapBcR4lN3e7Tj4' and 1=0 UNION SELECT 'a' WHERE 1=1-- #TRUE SELECT TrackingId FROM TrackedUsers WHERE TrackingId = 'u5YD3PapBcR4lN3e7Tj4' and 1=0 UNION SELECT 'a' WHERE 1=2-- #this returns no row - FALSE You should update learning materials, as this is not correctly explained (injection will not work).

Ben, PortSwigger Agent | Last updated: Jan 29, 2020 02:29PM UTC