Blind SQL injection with time delays
Exploited a blind SQL injection in a tracking cookie using time-based payloads. Confirmed vulnerability by triggering measurable delays and identifying PostgreSQL as the backend.
🎯 Objective
This lab contains a blind SQL injection vulnerability.
The application uses a tracking cookie for analytics, and performs a SQL query containing the value of the submitted cookie.
Goal:
- Exploit the injection using a time-based SQLi payload
- Prove the vulnerability by triggering a measurable delay
📝 Provided Information
- No credentials are required for this lab.
- Focus is on the tracking cookie parameter.
🔎 Analysis
Step 1: Identify the Vulnerable Parameter
First, I checked the requests and spotted that the tracking cookie was being sent.
This became the main target for injection testing.
Step 2: Measure Normal Response Time
With a valid request, the server responded quickly (about 50 ms).
This serves as a baseline to detect potential delays.
Step 3: Test Database Type
I tested different payloads to determine the backend database.
Based on the response behavior, it looked like the server was not using MySQL.
Next, I tried PostgreSQL-specific payloads.
This time, the request execution jumped to about 20,073 ms, confirming the injection worked.
🎉 Result
By exploiting the tracking cookie parameter, I successfully triggered a time delay using PostgreSQL syntax.
This confirms that the application is vulnerable to blind SQL injection (time-based). ✅