We already saw how an SQLi vulnerability works. In this recipe, we will cover a different vulnerability of the same kind, one that does not show an error message or a hint that could lead us to the exploitation. We will learn how to identify and exploit a blind SQLi.
Identifying and exploiting blind SQL injections
How to do it...
Log into DVWA and go to SQL Injection (Blind):
- The form looks exactly the same as the SQLi form we saw in the previous recipes. Type 1 in the textbox and click Submit to see the information about the user with the ID 1.
- Now, let's perform our first test with 1' and see whether we get an error as in previous recipes:
We get no error message, but no result either. Something interesting...
