SQL Injection – time delays and information retrieval| PortSwigger Lab Note #10

target：

• Lab URL:

https://portswigger.net/web-security/learning-paths/sql-injection/sql-injection-exploiting-blind-sql-injection-by-triggering-time-delays/sql-injection/blind/lab-time-delays-info-retrieval

• Tools Used:

1. browser

2. Burp suite

Vulnerability Summary：

• Type: Blind SQL Injection

• Description:

The results of the SQL query are not returned, and the application does not respond any differently based on whether the query returns any rows or causes an error. However, since the query is executed synchronously, it is possible to trigger conditional time delays to infer information.

Steps to Exploit：

1.Verify that the application responds with no time delay or time delay

2.confirming that there is a user called administrator.

3.determine how many characters are in the password of the administrator user

4.Determine the password

Remediation：

• Use parameterized queries / prepared statements

• Use server‑side input validation

• Escape and sanitize user input

Lessons Learned：