Blind SQL injection with conditional errors doesn’t work and no idea why ?

Blind SQL injection with conditional errors doesn't work and no idea why ?

hello friends

I am new to web pentesting and I am currently learning using PortSwigger. In the SQL injection section “Lab: Blind SQL injection with conditional errors”: I found that they use the following query to check if there will be an error or not

TrackingId=xyz'||(SELECT CASE WHEN (1=1) THEN TO_CHAR(1/0) ELSE '' END FROM dual)||' 

If I understood correctly, because 1=1, we will get 1/0
which will trigger an error in the backend. Using the same logic, I have tried to create my own query:

https://preview.redd.it/zok7gsghxyra1.png?width=654&format=png&auto=webp&s=864636e4638c011810cd3182e453879cd17a72db

But this seems to work fine. Can someone please explain why? Thank you so much for your help

submitted by /u/firend_of_laki
[link] [comments]

April 5, 2023
Read More >>