SQL Injection - Blind SQL Injection with Time Delays and Information Retrieval
Support This Channel
======================
Please like and subscribe, it means a lot!
Please buy me a coffee so I can continue to make content.
https://buymeacoffee.com/zenshell
My cybersec and webdev training site
https://www.zenshell.ninja
Join our Discord
/ discord
In this Portswigger lab we enumerate usernames and passwords from the underlying postgreSQL database by making use of a time-based blind SQL injection attack.
We demonstrate how to run the attack using Burp intruder but ultimately run the attack using SQLmap since the community edition of Burp throttles attacks made from the intruder tab.
By injecting into the trackingID cookie, we are able to ask the SQL database a range of granular true/false quesitons that slowly enumerates individual characters in the SQL table.