Boolean Blind SQLi Behind a WAF with a Five-Second Timeout
You are testing an e-commerce search at shop.example.com/search?q=widget. Errors are suppressed. A WAF returns 403 for requests containing UNION, SELECT, or SLEEP. The page shows “12 results” for widget. Adding a single quote returns the same 12 results; adding ' AND 1=2-- - returns “0 results”; ' AND 1=1-- - returns 12. The database is MySQL 8.0 according to a leaked stack trace from a different endpoint. The server has a 5-second response timeout, and the WAF rate-limits you to 10 requests per minute. The search term is reflected in the page title, HTML-encoded. You have a 90-minute window and need to confirm SQL injection and extract one piece of evidence, not dump the database.
1. How do you confirm this is SQL injection rather than a caching or WAF artifact? Give a test sequence within the rate limit.
Read the worked answer
Do not conclude from one pair of requests. Build a small, controlled sequence that varies the logical expression while keeping the query shape stable. Start with widget, widget', widget' AND 1=1-- -, and widget' AND 1=2-- -. Repeat each request once with a harmless cache-busting parameter such as &cb=1712345678 or with a slightly different search term that should produce the same logic. Record the result count, body hash, and title for each response. If 1=1 consistently returns 12 results and 1=2 consistently returns 0, the parameter is influencing SQL logic.
Add a control that does not use SQL comparison syntax, for example widget' AND 'a'='a versus widget' AND 'a'='b, and a numeric control such as widget' AND 2+2=4-- - versus widget' AND 2+2=5-- -. The numeric control helps rule out a WAF rule that simply matches the string 1=1. Use -- - with a trailing space because MySQL requires whitespace after the comment marker. At 10 requests per minute, this sequence is about 8 to 10 requests, so it fits within roughly one minute. If the results are stable across repeated and cache-busted requests and the controls behave as predicted, the evidence is strong. If the WAF returns 403 for some controls, record that and adjust rather than treating a block as a positive result.
2. Design a boolean-based extraction of the first character of the database name using binary search. Estimate requests and time, and explain how you avoid the WAF.
Read the worked answer
Avoid the blocked keywords. You do not need SELECT to call DATABASE(). Use a predicate such as:
widget' AND ASCII(SUBSTR(DATABASE(),1,1))>77-- -
A true condition returns the normal result count; a false condition returns zero results. Binary search over ASCII 0–127 takes seven requests per character. For the first character only, that is seven requests, or under a minute at 10 requests per minute. If the database name is eight characters, extracting the whole name costs about 56 requests, roughly six minutes, plus confirmation requests. That is feasible in the 90-minute window, but you only need one piece of evidence: extract the first character or the first two characters and stop.
Use URL encoding for spaces and special characters if the WAF normalizes plain text. Avoid SELECT, UNION, and SLEEP entirely. Do not use time-based payloads because SLEEP is blocked and the server timeout is five seconds. Keep the comment marker as -- - and confirm the baseline response for true and false before each binary-search step. If a request returns 403, do not immediately assume the predicate is false; treat it as a block, back off, and try a semantically equivalent expression such as ORD(SUBSTR(DATABASE(),1,1)) or MID(DATABASE(),1,1).
3. The WAF starts blocking after 30 requests. What adjustment do you make, and what is the ethical stopping point?
Read the worked answer
Reduce request volume and change the objective. If the WAF blocks after 30 requests, stop the binary search and extract only a single confirmation character or a short prefix rather than the full database name. Slow down below the rate limit, add delays, and avoid rapid repeated patterns. Try semantically equivalent functions to see whether the block is signature-based, but do not escalate into aggressive WAF evasion or high-volume fuzzing. The goal is to prove the vulnerability, not to defeat the WAF at any cost.
The ethical stopping point is the minimum evidence needed for a reproducible report: a true/false pair, one extracted character or database name prefix, and the exact requests and responses. Stop before extracting user data, password hashes, or full schemas. If the WAF blocks further extraction, document the block and report the confirmed injection with the evidence already obtained. Do not switch to destructive queries, do not attempt to write files, and do not use the injection to access other tenants. If the program has rules about data handling, redact the extracted value in the report and provide it only through the agreed channel.