Blind vs In-band as Defender Literacy

After a concatenating bug exists, testers and attackers still have to observe an effect. In-band (sometimes called first-order / same-channel) means the application’s normal response path leaked evidence: a database error string rendered in HTML, extra columns in a product list, a login that succeeded for the wrong reason. Blind means that path was quiet — generic errors, no extra rows — and evidence was inferred from a binary difference (page A versus page B) or from elapsed time. Both names still describe the Lesson 1 bug. Neither name is a permission slip. Neither name is a payload you copy into a classmate’s URL.

You will classify fictional one-line report cards. You will not write a true/false probe tree. You will not add SLEEP recipes. You will not install sqlmap “to see which type it is” on a host you do not own. If a blog titled with a cert acronym publishes boolean-blind character extraction as Module 15 homework, that blog is not this course. Topic 10’s injection module is where Cyberlium goes deeper on authorized local apps. This CEH-mapped path stops at defender vocabulary plus the same fix: parameterized queries.

sudo apt install sqlmap

brew install sqlmap

pip install sqlmap

cat >> "$NOTES" << 'EOF'
split_reason: how evidence returned to the tester/app
not_a_cookbook: no time-delay recipes, no sqlmap flags
EOF

When a finding says in-band SQL injection, read: the HTTP response (or another same-channel output the user already sees) reflected database errors or query results that should have been data-only. Error-based is the sub-label when verbose SQL errors reached the browser. UNION-based is a sub-label you may see when extra result columns appeared in the page. You now know enough to ask the developer: which input is concatenated, and where do we bind parameters instead? You do not need a UNION SELECT username, password FROM users line. This course will not paste that cheat sheet. Turning off verbose errors is hygiene (Lesson 3 will still say it is not the primary fix). Parameterized queries remain THE fix whether the report said error-based or UNION-based.

Recognition card (fiction, inspect only): “Finding: in-band SQLi on catalog search; response included a database error naming catalog_items.” Mechanism: concatenated input reached SQL; the same channel showed the engine’s complaint. Refusal: do not reproduce the error on the live shop; do not sqlmap the URL; file or imagine a ticket that says bind the search term. If this were YOUR app, you would open the query builder and replace glue with placeholders — Lesson 3 and Lesson 4. If this is not your app and you have no written RoE, you do not send a second request to “confirm.”

When a finding says boolean-based blind SQLi, read: the tester inferred a yes or a no from two different application outcomes (a different message, a different length, a different redirect) without seeing extra rows. When it says time-based blind, read: elapsed time was the signal because the page looked the same. That is enough literacy to understand severity talk: the data did not print, but the concatenating bug still let the database answer questions. The fix is still parameterized queries. This lesson will not give you AND 1=1 / AND 1=2 trees, substring loops, or database-specific delay functions to fire. Those are exploit steps. Topic 10 goes deeper in labs you own if you need to see a local demo. You do not need them to refuse a live hunt.

Recognition card (fiction, inspect only): “Finding: boolean-based blind SQLi on sku parameter; application behaved differently for two crafted conditions.” Mechanism: same concatenating bug; evidence left through behavior, not through dumped rows. Refusal: do not replay conditions against the host; do not automate thousands of questions; do not point sqlmap at it “because blind is hard by hand.” A professional test, if it ever exists for you, lives in a separate contract that names the app. Cyberlium does not assign that contract here. sqlmap named in a report you were given is a tool mention. sqlmap you aim at a stranger is unauthorized access.

sqli-blind-inband-notes.txt holds YOUR definitions plus ethics. Required rows: disclaimer, in-band meaning (same channel carried evidence), blind meaning (inference from difference or time), one sentence that both still equal concatenating SQL, THE fix (parameterized queries), Topic 10 goes deeper, NEVER list (no live SQLi, no UNION cheat sheet, no boolean-blind exploit steps, no sqlmap against strangers). chmod 600 under $HOME/cyberlium-lab. The checker fails if exploit-recipe phrases appear. Empty placeholders fail. A list of URLs to “try later” fails even if Python printed PASS.

If the notes feel “too small” because you did not extract a character, that is the point. Lesson 1’s microscope was grammar. This lesson’s microscope is a report title. Lesson 4’s hands are a rewrite you author against sqlite YOU created. None of those steps require a foreign production database. Module 14’s default remains: YOUR app or a local demo, not random sites, not a bounty you did not read.

Fill the notes in YOUR words. Run the checker; it only reads YOUR file. chmod 600. Do not paste boolean-blind recipes because the file felt short. Windows without chmod: WSL/Git Bash, or restrict the files in your profile.

sudo apt install sqlmap

brew install sqlmap

pip install sqlmap

cat >> "$NOTES" << 'EOF'
blind: evidence inferred (behavior/timing) not a dump on the page
refuse: exploit steps, sqlmap, time-delay kits
EOF

You now read in-band and blind as channel words on a finding, not as homework to reproduce. The bug is still concatenation. The fix is still parameterized queries. Topic 10 goes deeper in Cyberlium labs. Notes are locked. This is original Cyberlium material covering the same domain as CEH v13 SQL injection, not official training and not an exam dump. Next — Parameterized Queries and Least Privilege DB — is the actual fix, including ORM pitfalls.