DB.
Courses

Blind SQL Injection
OSWE · Chapter 9

Blind SQL Injection

Blind SQL injection occurs when the application is vulnerable to SQL injection but never reflects query results or database errors back in the response. Data must be extracted indirectly — via boolean conditions, timing delays, or out-of-band channels — one bit at a time.

Key concepts

  • Boolean-based: inject a condition and observe a difference in the response (e.g. "Welcome back" vs nothing) to infer true/false.
  • Time-based: inject a conditional delay (`IF(condition, SLEEP(5), 0)`) and measure response time when no visible difference exists at all.
  • Out-of-band (OAST): trigger a DNS/HTTP callback to an attacker-controlled server, exfiltrating data directly in the subdomain of the lookup — often the most reliable technique when others fail.
  • The prevention is identical to normal SQL injection: parameterized queries. Blind SQLi is only harder to *find and exploit*, not fundamentally different to prevent.

Example

-- Boolean-based probe
xyz' AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='a

-- Time-based probe (MySQL)
xyz' AND IF(1=1, SLEEP(5), 0)-- -

Try it yourself

On a lab blind-SQLi challenge (PortSwigger Web Security Academy has several labs), extract a single character of a password using the time-delay technique and confirm it against the boolean-based technique for the same character.

ReferenceSearch video walkthroughs

@ Daniel Burlacu