Class: Msf::Exploit::SQLi::MySQLi::TimeBasedBlind

Inherits:
Common
  • Object
show all
Includes:
TimeBasedBlindMixin
Defined in:
lib/msf/core/exploit/sqli/mysqli/time_based_blind.rb

Overview

Time-Based Blind SQL injection support for MySQL/MariaDB

Constant Summary

Constants inherited from Common

Common::ENCODERS

Instance Attribute Summary

Attributes inherited from Common

#concat_separator, #datastore, #framework, #null_replacement, #safe, #second_concat_separator, #truncation_length

Attributes included from Rex::Ui::Subscriber::Input

#user_input

Attributes included from Rex::Ui::Subscriber::Output

#user_output

Instance Method Summary collapse

Methods included from TimeBasedBlindMixin

#blind_request, #run_sql

Methods inherited from Common

#current_database, #current_user, #dump_table_fields, #enum_database_encoding, #enum_database_names, #enum_dbms_users, #enum_table_columns, #enum_table_names, #enum_view_names, #initialize, #read_from_file, #version, #write_to_file

Methods inherited from Common

#initialize, #raw_run_sql, #run_sql

Methods included from Module::UI

#init_ui

Methods included from Module::UI::Message

#print_error, #print_good, #print_prefix, #print_status, #print_warning

Methods included from Module::UI::Message::Verbose

#vprint_error, #vprint_good, #vprint_status, #vprint_warning

Methods included from Module::UI::Line

#print_line, #print_line_prefix

Methods included from Module::UI::Line::Verbose

#vprint_line

Methods included from Rex::Ui::Subscriber

#copy_ui, #init_ui, #reset_ui

Methods included from Rex::Ui::Subscriber::Input

#gets

Methods included from Rex::Ui::Subscriber::Output

#flush, #print, #print_blank_line, #print_error, #print_good, #print_line, #print_status, #print_warning

Constructor Details

This class inherits a constructor from Msf::Exploit::SQLi::MySQLi::Common

Instance Method Details

#test_vulnerable ⇒ Boolean

This method checks if the target is vulnerable to Blind time-based injection by checking if the target sleeps only when a given condition is true, and doesn’t when it’s false.

Returns:

  • (Boolean) —

    Whether the check confirmed that the time-based SQL injection works



13
14
15
16
17
 
# File 'lib/msf/core/exploit/sqli/mysqli/time_based_blind.rb', line 13

def test_vulnerable
  out_true = blind_request("if(1=1,sleep(#{datastore['SqliDelay']}),0)")
  out_false = blind_request("if(1=2,sleep(#{datastore['SqliDelay']}),0)")
  out_true && !out_false
end