What is the blind SQL injection attack?

Many web applications use SQL to store or retrieve sensitive data of the users to or from the database. The data may be user credentials, transaction details, or other data useful to the web application. For example, let’s suppose a user wants to search for the availability of a book on an e-commerce website. To do so, he will first enter the author or title of the book in the search bar. At that time, the web application will receive the user input, process it, and make appropriate SQL queries to the database. It will then process the output returned by the database and display that to the user after nicely formatting it.

But, sometimes, a web application can have security vulnerabilities, and the attackers can exploit those to update, delete, or steal sensitive data stored in the database. A blind SQL injection attack, which is a type of SQL Injection Attack (What is the SQL injection attack?), is one such attack that attackers widely perpetrate to extract information about the database. Let’s understand how the attack works in more detail.

How does the blind SQL injection attack work?

Suppose in a web application, ecommerce.com, a user can search for a particular book with the name of the author or title or description of the book. When the user inputs “John” in the search bar, the following URL is loaded:

ecommerce.com/books.php?author=john

This results in the execution of the following SQL query to the database:

SELECT * FROM bookinfo WHERE author = ‘john’;

And, the output is nicely formatted and shown to the user.

But suppose an attacker loads the URL:

ecommerce.com/books.php?author=john OR 1=1

If the web application embeds the user input to the SQL query directly, it will result in execution of the following SQL query in the database:

SELECT * FROM bookinfo WHERE author = ‘john’ OR 1 = 1;

And in that case, the web application will list all the books from the database and show them all on the webpage shown to the attacker.

Now, the attacker can load the following URL next:

ecommerce.com/books.php?author=john AND 1=2

And if the web application has blind SQL injection vulnerabilities, this will result in the execution of the following SQL query:

SELECT * FROM bookinfo WHERE author = ‘john’ AND 1 = 2;

Clearly, the database will return ‘false.’ And, if the web application shows generic error messages or error messages from the database, it will reveal enough information to the attacker. By executing these two queries, the attacker will confirm that the web application has blind SQL injection vulnerabilities. So, he can execute even more queries to extract more information, like the version of SQL used, etc. These types of attacks that test the database with various queries, like true and false queries, and extract information so that the attacker can plan for even more attacks are …