Injection: Boolean-based Blind SQL Injection¶

Identifier: sql_injection_boolean_based

Scanner Support¶

Description¶

Boolean-based blind SQL injection lets an attacker read the database one bit at a time, even when the application never shows a SQL error: the response changes depending on whether an injected condition is true or false.

How we test: We append an always-TRUE and an always-FALSE SQL condition to each path, query, and JSON string argument, in numeric, quoted, and parenthesized contexts. We report the argument when the TRUE condition returns the original response while the FALSE condition returns a different one, and a second TRUE/FALSE pair with other values reproduces the same two responses.

Prerequisites:

• The target must expose at least one request parameter that can be tested.
• The original response must be stable: two identical replays must return the same response.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  sql_injection_boolean_based:
    skip: false

Reference¶

skip¶

Type: boolean

Skip the test if true.