📄 Blind SQL Injection – Lab Report

Description:

This lab contains a blind SQL injection vulnerability in a tracking cookie used for analytics. The application does not return query results or errors, but it displays a "Welcome back" message when the query returns at least one row.

🧠 Vulnerability Explanation

The application executes a SQL query like:

SELECT trackingidFROM TrackedUsersWHERE Trackingid='value'

Since the query result is not visible, we rely on a Boolean-based blind SQL injection technique.

If the condition is true, the page shows "Welcome back".

If false, no message appears.

⚔️ Testing for Injection

We test with:

'xyz'OR'a'='a

If the "Welcome back" message appears → the input is vulnerable.