Detailed Technical Analysis of "Time-Based SQL Injection on bWAPP"

Overview:
This write-up by CRK2500 discusses the discovery and exploitation of a Time-Based Blind SQL Injection vulnerability in the bWAPP (Buggy Web Application). This type of SQL Injection does not directly return data but instead relies on time delays to infer results, making it particularly useful when error-based or union-based SQL injection is not possible.

Key Technical Details:

1. Understanding Time-Based Blind SQL Injection:
2. Blind SQL Injection: Unlike traditional SQL Injection, blind SQL Injection does not provide direct feedback via the application's output. The data is inferred indirectly, often by monitoring web responses.

3. Time-Based Technique: This specific form uses SQL commands that cause deliberate time delays (usually via the SLEEP function) to infer the truthfulness of a particular SQL query component. For instance, a true condition could cause a delay, while a false condition will not.

4. The Target Page:

5. The target page /sqli_11.php on the bWAPP application is used for demonstrating this vulnerability: php $sql = "SELECT * FROM users where id = '$id'";

6. The id parameter is vulnerable to injection. Since the input parameter id is directly concatenated into the query without proper sanitization, an attacker can inject arbitrary SQL.

7. Crafting the Payload:

8. The attacker crafts specific payloads to manipulate the id parameter that controls the duration of the SQL query's execution based on conditional logic.
9. Example payload verifying SQL Injection: 1 AND SLEEP(5)

10. If the application takes noticeably longer to respond, it confirms the presence of SQL Injection.

11. Exploiting the Vulnerability:

12. Confirming Injection Point: Using a payload like 1 AND SLEEP(5), the attacker notes that the server's response is delayed by 5 seconds, confirming the injection point.

13. Determining Database Type: By carefully crafting payloads, the attacker can determine the type of database management system (DBMS) in use. For instance: sql 1 AND (SELECT * FROM (SELECT(SLEEP(5)))a)

    • A delay confirms the payload is valid, helping deduce the DBMS specifics.

14. Extracting Data: The core of blind injection techniques involves guessing data step-by-step:

    • For example, to extract the database version one character at a time: sql 1 AND IF(SUBSTR(DATABASE(),1,1)='b', SLEEP(5), 0)
    • If the response is delayed, it implies the first character of the database name is 'b'.
    • This process can be repeated iteratively to extract entire values.

15. Automation with SQLMap:

16. SQLMap, an automated SQL injection tool, can streamline the attack process: bash sqlmap -u "http://[target]/sqli_11.php?id=1" --dbms=mysql --level=5 --risk=3 --time-sec=5 --technique=T --batch
17. SQLMap automatically tests and exploits the SQL Injection using time-based techniques, efficiently extracting database details.

Key Takeaways:

• Security Best Practices:
• Prepared Statements: Always use prepared statements or parameterized queries to avoid SQL Injection.
• Input Validation: Sanitize and validate all user inputs rigorously.

• Database User Permissions: Employ the principle of least privilege for database users to limit the potential damage from SQL Injection.

• Detection and Mitigation:

• Web Application Firewalls (WAFs): Deploy WAFs that can detect and block unusual time delays indicating potential time-based SQL Injection.

• Monitoring and Logging: Implement robust logging mechanisms to monitor abnormal delays in query execution times, which may indicate an ongoing attack.

• Exploitation Technique:

• Time-Based Delays: Exploiting time-based SQL Injection involves crafting queries that include conditional delays (e.g., using SLEEP(n)).
• Automating with SQLMap: SQLMap can significantly simplify the exploitation process by automating payload generation and data extraction.

Conclusion:

Time-Based Blind SQL Injection is a powerful exploitation technique, especially in scenarios where error messages or direct data retrieval are not feasible. This analysis of CRK2500's write-up demonstrates how vulnerabilities in seemingly benign input fields can be leveraged to infer sensitive database information. It underscores the critical need for strict input sanitization and security best practices in web application development.

For full details, check the original post here.