Bug Bounty: Automate Blind SQLi

I wanted to share an epic win with you for you. A simple way to automate blind SQLi with Nuclei.

To begin, let’s create a Nuclie template, but let’s make it a bit more advanced to leverage the clusterbomb method. This approach will allow us to effectively brute force the endpoints that pique our interest.

Github link to sqli_b_sleep.yaml

Wait what’s going on here, let’s break it down…

In the below image, you can see we are using only GET requests for now.

Think of the curly braces like replacement holders.

You can update the template and learn more about templating with nuclei here: https://nuclei.projectdiscovery.io/templating-guide/

For the next section, we see payloads (more info: https://nuclei.projectdiscovery.io/templating-guide/protocols/http/#http-payloads)

We can specify any payloads following the format in the link above, namely.

For the payloads for now I have only added a few, but you can add as many as you know and love

Next, we have the clusterbomb settings section.

This tells us the attack type with how many threads to run (to speed up the scan) and to make sure we stop on the first match, then continue to test the next URL.

Next, we set the matcher conditions. We use the DSL extractor to get more accurate results. With the dsl, we can access the duration of the request to see how long it takes. I’ve set all the payloads to seven seconds. Hence the duration is between seven and eight seconds for a match.

In this, the last section we are checking to make sure none of the words in the list are found. If all checks out at this point we should have a valid hit!

You can use nuclei in many ways, I prefer to test some scripts with project discovery's other tool, Katana.

Save the template above to a name you can remember: sqli_b_sleep.yaml

By utilizing Nuclei and Katana in tandem, we can identify potential vulnerabilities and assess the security of web applications effectively. This combined approach allows for thorough testing and provides valuable insights into the targets you’re attacking.

It seems like everything is working smoothly. Now, armed with this method, you can effortlessly tackle those bounties on autopilot, at least for blind sqli.

And when you score a hit using this approach, don’t forget to remember me! Haha, I’d appreciate it. ;)

In addition to the methods mentioned above, these techniques can be applied to various other vulnerabilities and exploits. To explore more templates and gain a deeper understanding, I recommend checking out the nuclei templates repository. It contains a wide range of examples showcasing different attack types. You can find the repository on GitHub at this link: https://github.com/projectdiscovery/nuclei-templates.

Thanks for reading and give a thumbs up if you liked the content!