Lab: Blind SQL injection with conditional errors
Summary: PortSwigger's lab presents a blind SQL injection in a tracking cookie that the application feeds into a SQL query, where query results are not returned and responses differ only when the query causes an error, which returns a custom error message. The lab uses an Oracle database containing a users table with username and password columns, and the exercise is to extract the administrator password, which the lab states is 20 characters long, then log in as administrator.
Why it matters: The injection point is an analytics tracking cookie, and the only signal the attacker needs is a custom error message - enough to confirm the administrator account exists and to extract a 20-character password one character at a time through Burp Intruder.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026