..
teck’-SLEEP(5)#
Time-based SQL Injection is an inferential SQL Injection technique that relies on sending an SQL query to the database which forces the database to wait for a specified amount of time (in seconds) before responding. The response time will indicate to the attacker whether the result of the query is TRUE or FALSE.
teck’-IF(MID(VERSION(),1,1) = ‘5’, SLEEP(5), 0)#
Depending on the result, an HTTP response will be returned with a delay, or returned immediately. This allows an attacker to infer if the payload used returned true or false, even though no data from the database is returned. This attack is typically slow (especially on large databases) since an attacker would need to enumerate a database character by character.
Twitter / Hack The Box / CTF Team / Teck_N00bs Community Telegram
Comments