Introduction – application enumeration
As security auditors, we daily encounter solutions whose exact structure or logic is unknown to us. Therefore, one of the first and fundamental steps in conducting a security audit is the process of gathering information about the solution being tested. In this case, the story concerns a web application.
While enumerating available resources in the tested application using the ffuf tool, we managed to locate the /panel/ directory. Further attempts to identify the contents of this directory revealed the presence of a download_file.php file, which returned a blank page in the browser. A simple attempt to provide a basic parameter in the form of an HTTP GET id revealed that the application successfully processed it, returning the difference in the response, as demonstrated below.
Example HTTP request:
Further analysis – locating the Blind SQL Injection vulnerability
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 01 Oct 2025 14:39:09 GMT
Content-Type: directory
Connection: keep-alive
Content-Disposition: attachment; filename="test"
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 0
In short: Blind SQL Injection doesn’t return any direct database content to the attacker nor display SQL errors. Based on the application’s response, we can only determine whether the query is TRUE or FALSE. Therefore, through trial and error and repeated queries, the attack could proceed as follows:
