‫So in a normal scenario, when you get an actual error, then you can shave Enescu all injection attack
‫and when you don't get an error, you can try Boolean technique's.
‫But there were other times that sometimes even this doesn't work.
‫So in this lesson, we're going to examine another school injection, OK, open school injection, blind
‫time-based.
‫So as in the previous lesson, you will see a simple search field, so let's try something to search.
‫And maybe a single quote could leak something, hmm, nothing.
‫So it seems that we always display the same page, same response.
‫Yeah, and we have nothing to determine whether our searches or payloads reach the database and execute.
‫OK, folks, open your terminals before going any further.
‫Them as Kuli underscore 15 dot BHP.
‫So online, 26.
‫Air reporting is turned off.
‫That explains why we don't get the errors.
‫And rigorous security checks, here they come.
‫So this part is important to us here, the actual query is just like this.
‫It's not any different to the previous query that we see in boolean based escarole injection.
‫Then this query execute.
‫And if there's no error and the ResultSet is not empty, then it does something.
‫Actually, it sends an email to the user's address.
‫So scroll down a little bit.
‫Now, this is a search box.
‫There is no code that can affect the page here.
‫So go back.
‫OK, I forgot to try boolean values.
‫So type or one equals one.
‫Nothing happens.
‫At a harsh character.
‫No, nothing.
‫All right, change one to two and try.
‫Nothing happens yet, I'm I'm the one who's supposed to know what he's doing right now, what I'm showing
‫you here is you can tell the comparing with boolean operators doesn't necessarily work all the time.
‫So that means that we need to use time based escarole payloads, which is what I guess I began telling
‫you.
‫But I want you to see when you need to use.
‫So now let's have a look at this payload.
‫Now, focus on the end statement.
‫So if the whole query is legitimate, the left side of the and will execute very quickly and the right
‫side of the end will sleep for two seconds and then execute.
‫So we're going to observe the page for the response.
‫If the page loads approximately after two seconds, then it means we get an actual injection, so quick
‫search.
‫And look at the left lower corner browsers waiting for the page.
‫Now, I forgot to count for two seconds, but you can see it works.
‫And then you can shape the payload to pull data.
‫But I'm going to show you some other types of payloads as well, so let's have a look at this one.
‫Oh, no, no, wait, wait, wait.
‫You can also use this, the benchmark function.
‫So there's several payloads with Benchmark's.
‫And now we can perform the version detection.
‫So use this payload.
‫And if the first character of the version is five, it will sleep for two seconds.
‫Yes, so it waits so you can get all one by one.
‫And then right this payload to get the first character of the current database.
‫The page will load after two seconds of its B.
‫And yes, it is B.
‫OK, so try this one to get the length of the current database up, no, wait, wait, then change it
‫here to five and search.
‫And yes, it has five characters, so to learn the length, you can also use the like operator with
‫placeholders.
‫So let's add one more placeholder.
‫Yeah, it works.
‫OK, so I think I think you get the point now.
‫Yeah.
‫Now, I, of course, have several other payloads, but they do pretty much the same things.
‫So I'm going to share all that with you in a separate file, and I'm going to stop at this point and
‫you can try some of the other payloads on your own, go for broke, see what you can do.