Blind SQL Injection

引用 OWASP - Blind SQL Injection 简介:

Blind SQL (Structured Query Language) injection is a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the applications response. This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

When an attacker exploits SQL injection, sometimes the web application displays error messages from the database complaining that the SQL Query's syntax is incorrect. Blind SQL injection is nearly identical to normalSQL Injection, the only difference being the way the data is retrieved from the database. When the database does not output data to the web page, an attacker is forced to steal data by asking the database a series of true or false questions. This makes exploiting the SQL Injection vulnerability more difficult, but not impossible. .

Blind SQL (盲注) 是注入攻击的其中一种, 向数据库发送 true 或 false 这样的问题, 并根据应用程序返回的信息判断结果. 这种攻击的出现是因为应用程序配置为只显示常规错误, 但并没有解决SQL 注入存在的代码问题.

当攻击者利用SQL注入漏洞进行攻击时, 有时候web应用程序会显示, 后端数据库执行SQL查询返回的错误信息. Blind SQL (盲注)与常规注入很接近, 不同的是数据库返回数据的检索方式. 若数据库没有输出数据到web页面, 攻击者会询问一些列的 true 或 false 问题, 强制从数据库获取数据. 这样做让数据注入攻击变得困难, 但并不是不可能.

盲注常分为:  【基于布尔型的盲注】 和 【基于时间的盲注】.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

以 https://github.com/Audi-1/sqli-labs 的Less-8与Less-9为例, 进行说明.
Less-8 : 基于布尔型的盲注.
Less-9 : 基于时间的盲注.

Less-8 部分源代码如下:

$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
 
    if($row)
    {
      echo '<font size="5" color="#FFFF00">';    
      echo 'You are in...........';
      echo "<br>";
        echo "</font>";
      }
    else  
    {
    
    echo '<font size="5" color="#FFFF00">';
    //echo 'You are in...........';
    //print_r(mysql_error());
    //echo "You have an error in your SQL syntax";
    echo "</br></font>";    
    echo '<font color= "#0000ff" font size= 3>';    
    
    }
}
    else { echo "Please input the ID as parameter with numeric value";}

注入时，没有显示错误信息，因此我们不能判断该页面面是否存在注入问题。这也就是被称为盲注的原因。
基于布尔型的盲注，我们通常采用下面的办法猜解字符串.

select length(databse());
select substr(databse(),1,1);
select ascii(substr(database(),1,1));
select ascii(substr(database(),1,1)) > N;
select ascii(substr(database(),1,1)) = N;
select ascii(substr(database(),1,1)) < N;