July 23, 2026
Blind SQL injection attack with Conditional Responses using Sniper and Cluster Bomb
Blind SQL Injection is a type of SQL injection where the application does not show query results or database errors, but an attacker can…
By CyberLabyrinthX
3 min read
Blind SQL Injection is a type of SQL injection where the application does not show query results or database errors, but an attacker can still extract data by observing differences in the application's behavior (such as responses or timing). As a result, many attack techniques, including UNION-based attacks, are ineffective.
In this case, the application processes the TrackingID value from the cookie header and includes it in a SQL query. By injecting payloads into this parameter and observing the application's behavior, we can test whether the application is vulnerable to blind SQL injection.
Using the payloads below, it was easy to determine whether the vulnerability exists. As you can see, the "Welcome back" message appeared when the condition evaluated to true ' AND '1'='1 and disappeared when it evaluated to false ' AND '1'='2. This difference in application behavior confirms the presence of a blind SQL injection vulnerability.
'+AND+'1'='1
'+AND+'1'='2'+AND+'1'='1
'+AND+'1'='2After confirming that the "Welcome back" message appears when the condition evaluates to true, the following exploit was used to verify the existence of a user named administrator in the users table.
'+AND+(SELECT+'a'+FROM+users+WHERE+username='administrator')='a'+AND+(SELECT+'a'+FROM+users+WHERE+username='administrator')='aAfter confirming the existence of the administrator user, the following payload was used to determine the length of the user's password.
'+AND+(SELECT+'a'+FROM+users+WHERE+username='administrator'+AND+LENGTH(password)>1)='a'+AND+(SELECT+'a'+FROM+users+WHERE+username='administrator'+AND+LENGTH(password)>1)='a
In the payload above, the number in the LENGTH(password) > 1 condition is incremented with each request (e.g., 1, 2, 3, and so on) to determine the password length. During this process, the "Welcome back" message continues to appear while the condition is true. Once the condition becomes false, the message disappears and indicates that the correct password length has been reached.
To automate this process, I used the Sniper attack type in Burp Suite Intruder, which allowed me to systematically iterate through values and efficiently determine the result.
I placed the payload position on the numeric value 1 and in the Payloads configuration panel, I set the payload type to Numbers then defined a range from 1 to 50 as an estimated password length.
Before launching the attack, I configured the Grep — Match feature to flag responses containing the "Welcome back". This allowed me to quickly distinguish between true and false conditions based on the presence or absence of this message.
After determining the password length, the following payload was used to brute-force each character individually in order to fully extract the password.
'+AND+(SELECT+SUBSTRING(password,1,1)+FROM+users+WHERE+username='administrator')='a'+AND+(SELECT+SUBSTRING(password,1,1)+FROM+users+WHERE+username='administrator')='aFor this step, both Sniper and Cluster Bomb attack types can be used. The main difference is that Cluster Bomb can save time by testing multiple positions and characters simultaneously, while Sniper works sequentially. In Sniper, the process goes character by character: first X = 1 is tested with all characters (a–z), then X = 2 with a–z, and so on.
In the first Payloads tab of Burp Suite Intruder, the payload type is set to Numbers, with a sequential range configured from 1 to 20. This allows Intruder to automatically iterate through numeric values. In the second Payloads tab, the payload type is set to Simple list, where a list of lowercase characters (a–z) and digits (0–9) is provided. This enables systematic brute-forcing of each character.
After successfully extracting the password, I was able to log in to the administrator account.
