Lab: Blind SQL injection with conditional responses
Summary: PortSwigger's lab presents a blind SQL injection in an application that runs a SQL query on the value of a tracking cookie for analytics, returning no query results and no error messages. The only signal is a 'Welcome back' message that appears when the query returns rows, which the lab uses to confirm a users table, an administrator user, and a 20-character password extracted one character at a time with the SUBSTRING() function in Burp Intruder.
What you should know: The application leaks a full administrator password through a single boolean response - the presence or absence of a welcome message - so a control that only watches for errors and returned data would see nothing while the password is read out character by character.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026