
Summary
Blind Boolean SQL Injection is a specific form of SQL injection attack that leverages the ability of the attacker to infer information from the database by analyzing the responses received based on the truth value of the injected SQL queries. Unlike traditional SQL injection that can return data from the database, this technique merely tells the attacker whether a given query is causing the application to return a true or false value, thus allowing them to extract information bit by bit. The attack typically involves sending crafted SQL statements that include conditional statements, such as `IF`, `NULL`, `ISNULL`, or boolean operations, to manipulate the behavior of the SQL interpreter. If the server response changes according to the truthfulness of the query, the attacker can deduce information about the data structure and content within the database. This method is particularly time-consuming and resource-intensive, requiring multiple requests to effectively enumerate database entries, especially in larger datasets. The provided rule aims to detect patterns associated with such SQL injection attempts by monitoring web application firewall logs for specific SQL keywords and conditions indicative of this attack type.
Categories
- Web
Data Sources
- Web Credential
- Application Log
ATT&CK Techniques
- T1190
Created: 2024-02-09