SQL Injection - Blind SQL Injection With Time Delays
Support This Channel
======================
Please like and subscribe, it means a lot!
Please buy me a coffee so I can continue to make content.
https://buymeacoffee.com/zenshell
My cybersec and webdev training site
https://www.zenshell.ninja
Join our Discord
/ discord
In this lab we explore the pre-requisite knowledge for running a time based SQL injection attack.
We inject into a trackingId cookie which is used as part of a postgreSQL query run on the backend. We are able to inject the pg_sleep command into the underlying SQL query by making use of the postgreSQL concatenation operator.
As we'll see in later labs, it's possible to leverage the fact that the database sleeps to extract information from the database tables.