For as long as SQL injection has been around, it is still not old news — at least for attackers. Attackers will take whatever path they can to reach an exploit The simpler the path, the better. However, sometimes they need to use a little more elbow grease.

That’s where blind SQL injection comes in. If an attacker were a magician, this attack would be the last handkerchief out of his SQL injection sleeve.

What Is Blind SQL Injection?

The Open Web Application Security Project (OWASP) gave the following definition of blind SQL injection:

“Blind SQL (Structured Query Language) injection is a type of SQL injection attack that asks the database true or false questions and determines the answer based on the application’s response. This attack is often used when the Web application is configured to show generic error messages but has not mitigated the code that is vulnerable to SQL injection.”

This is called a blind attack because the actor can’t easily see the intended target without asking the important questions. An attacker typically uses blind SQL injection if traditional methods continually fail to glean information. Blind injection is a last resort.

Blind SQL Injection Attack Metrics

IBM Managed Security Services continuously monitors billions of events reported every year by client devices in over 100 countries. Analysis of the blind SQL injection data accumulated between Jan. 1, 2015, and Nov. 30, 2015, revealed some interesting findings.

Clearly, traditional SQL injection attempts win out over blind SQL injection attempts, but there are some months when attackers make a concerted effort against their targets to use blind SQL injection.

Mitigating Blind SQL Injection

Without investing time into testing, it’s virtually impossible to tell if your database deployment and its front-end infrastructure are vulnerable to blind SQL injections. SQL injection testing tools can help organizations identify SQL weaknesses in applications — but attackers can use those same tools to find entry points into the same applications.

Interested in the evolving cyber threat landscape? Read the latest IBM X-Force Research

More from Software Vulnerabilities

FYSA – Critical RCE Flaw in GNU-Linux Systems

2 min read - Summary The first of a series of blog posts has been published detailing a vulnerability in the Common Unix Printing System (CUPS), which purportedly allows attackers to gain remote access to UNIX-based systems. The vulnerability, which affects various UNIX-based operating systems, can be exploited by sending a specially crafted HTTP request to the CUPS service. Threat Topography Threat Type: Remote code execution vulnerability in CUPS service Industries Impacted: UNIX-based systems across various industries, including but not limited to, finance, healthcare,…

X-Force discovers new vulnerabilities in smart treadmill

7 min read - This research was made possible thanks to contributions from Joshua Merrill. Smart gym equipment is seeing rapid growth in the fitness industry, enabling users to follow customized workouts, stream entertainment on the built-in display, and conveniently track their progress. With the multitude of features available on these internet-connected machines, a group of researchers at IBM X-Force Red considered whether user data was secure and, more importantly, whether there was any risk to the physical safety of users. One of the most…

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today