INFO LAB : →

This lab contains a blind SQL injection vulnerability. The application uses a tracking cookie for analytics, and performs a SQL query containing the value of the submitted cookie.

The results of the SQL query are not returned, and the application does not respond any differently based on whether the query returns any rows or causes an error. However, since the query is executed synchronously, it is possible to trigger conditional time delays to infer information.

The database contains a different table called users, with columns called username and password. You need to exploit the blind SQL injection vulnerability to find out the password of the administrator user.

GOAL : →

To solve the lab, log in as the administrator user.

🧩 First Step: Detect the Database Type

🔍 Goal: Detect the type of database used by the application.

🛠 Detection Attempt:

I suspect the database is PostgreSQL, and I'm verifying this using sqlmap.

❌ Initial Payload (Did not work):

' || pg_sleep(10)--

but it’s does not work let’s try to put it in condition

x' || (SELECT CASE WHEN(1=1) THEN pg_sleep(10) ELSE pg_sleep(0) END)--

it’s work and delay the response for 10 seconds

Let’s try to get the password 🔒