Waraxe IT Security Portal

Tori · Regular user

[edited by request]

Tori · Regular user

[edited by request]

Heintz · Valuable expert

blind sql injection is more complicated then your case.
like a when there are no error messages and all you get is a "boolean" from web-page, by looking if it executed normally or it redirected you or gave some other sort of "hidden" error message (note: not a sql error message, a message like "sorry, server encountered an error" or similar). then getting any info from it gets much more trickier.

your injection is interesting too, but without a possibility to test i'm not able to give good help. what you need to do is be very open minded about all possibilities,
like a method called (i think), "fishing" , what it basically means is that you make a subquery and use "LIKE", regular expression operators (if possible) in where clause to see if match is found in password column and make the subquery return a "signal" about it.

edit: you might want to look through Waraxe-s advisories, he had a perl script with this conscept somewhere around here.

hope it helps somewhat Smile