Using binary search algorithms for blind sql injection
summary
Applies a binary search algorithm to boolean blind SQL injection and shows concrete gains versus character‑by‑character queries, implemented as a Python script hitting a Docker DVWA instance through Burp and a slow VPN link, validating vulnerability with true/false probes, then extracting version strings; sequential search runs about 12.5 seconds and makes 65258 requests while the binary approach completes in 3.6 seconds with 195 requests, proving fewer rounds and orders of magnitude fewer requests.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:25About Juan Pablo
- 1:47Agenda
- 2:42Background
- 6:36What is blind
- 8:23Blind sql injection
- 9:12Binary search algorithm
- 10:14Binary search example
- 11:02Lab
- 11:24Lab setup
- 12:02Script explanation
- 12:54Request function
- 17:19Validation
- 19:38Mixing
- 20:44Injection
- 22:31Binary search
- 24:27Script
- 26:40Sequential search
related talks
26mAll Your Queries Are Belong to Us: The Power of File-Injection Attacks...
41mSQL Injection Isn't Dead: Smuggling Queries at the Protocol Level
40mDifferences Between Web Application Scanning Tools when Scanning for XSS and SQLi
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
51mTiming Attacks Have Never Been So Practical: Advanced Cross-Site Search Attacks
51mMaking the most of Security Tests
22mIntegrating Security Measures Throughout Development
39mSelect Bugs From Binary Where Pattern Like CVE-1337-Days