Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 48

Time-Based Blind SQL Injection with Delay Functions

Recommended resources

In our previous lesson, we explored how to exfiltrate data using Boolean-based blind SQL injection, relying on subtle changes in an application's response to answer "yes" or "no" questions. But what happens when a vulnerability is truly silent—when the application returns the exact same page, with the same headers and content, whether your injected condition is true or false?

This lesson addresses that exact scenario. We will delve into time-based blind SQL injection, a powerful technique that works even when there is no visible feedback. You will learn how to force the database to pause execution, using the response time itself as your only channel for communication. By the end of this lesson, you will be able to confirm time-based vulnerabilities by injecting database-specific delay functions, turning a silent application into one that answers your questions through calculated delays.

When the Application Offers No Clues

In a time-based attack, instead of looking for a change in the page content, we introduce a payload that tells the database: "If this condition is true, wait for 10 seconds before responding." If the HTTP response is delayed, we know our condition was met. If it returns immediately, we know it was false. Time becomes our true/false indicator.

Since this technique is database-dependent, a crucial first step is knowing which function to use.

🧪 Exploiting Blind SQL Injection by Triggering Time Delays

This article provides an excellent introduction to the concept of time-based injection.

Read the first two sections, Objective and Key Concepts. Pay close attention to the table of delay functions. As a security analyst, knowing the correct syntax for different database management systems (DBMS) is essential for effective testing.

Confirming the Vulnerability with a Time Delay

Let's move from theory to a practical demonstration. We will analyze a lab where the only way to confirm an SQL injection vulnerability is by triggering a time delay.

The following video shows how to approach a target where Boolean-based techniques from our last lesson would fail. The instructor, Rana Khalil, methodically tests different payloads to find the correct syntax for the target database.

SQL Injection - Lab #13 Blind SQL injection with time delays

This video from Rana Khalil's series demonstrates the initial discovery and confirmation of a time-based blind SQLi vulnerability.

Watch these segments to understand the process of confirming the vulnerability: Understand the Scenario: First, watch the introduction from the beginning to understand why time-based injection is necessary for this particular lab. Crafting the Payload: A common point of failure is incorrect payload syntax. Watch from this section where an initial attempt is made. Then, critically, observe the explanation from this segment where the correct payload structure is explained: you must close the existing string and comment out the rest of the query. Successful Confirmation: Finally, watch the successful attack from this point. Notice how the response in Burp Suite visibly "hangs" before completing, and the response time confirms the 10-second delay was executed by the database.

The PortSwigger lab page itself provides a concise summary of the solution, which is a great reference. The core of the attack is this payload for a PostgreSQL database:

TrackingId=x'||pg_sleep(10)--

Here's the breakdown:

  • x' : The x is arbitrary. The single quote ' closes the opening quote around the cookie value in the server-side query.
  • || : This is the string concatenation operator in PostgreSQL.
  • pg_sleep(10) : This is the PostgreSQL function that causes a 10-second delay.
  • -- : This comments out the rest of the original query, preventing a syntax error from the original query's trailing single quote.

The image below shows another example of a successful time-based attack, this time against a MySQL database. Notice the sleep(6) in the request payload and the resulting response time of over 6,000 milliseconds.

This screenshot shows a time-based SQL injection against a MySQL server. The payload in the `X-Forwarded-For` header uses an `IF` statement with `sleep(6)`. The response time of 6,517 milliseconds confirms the database executed the delay, proving the vulnerability.

From Simple Delays to Conditional Logic

Confirming that you can cause a delay is the first step. The real power comes from making that delay conditional. By wrapping the sleep function in a conditional statement, you can ask the database true/false questions, just as we did in the previous lesson.

The structure for this is typically:

  • PostgreSQL: CASE WHEN (condition) THEN pg_sleep(10) ELSE NULL END
  • MySQL: IF(condition, sleep(10), 0)
  • SQL Server: IF (condition) WAITFOR DELAY '0:0:10'

Let's see this in action. The next lab video builds upon the last one, demonstrating how to construct a query that only sleeps if a certain condition is met.

SQL Injection - Lab #14 Blind SQL injection with time delays and information retrieval

This video demonstrates how to turn a simple time delay into a conditional true/false test.

Watch the segment from 4:35 to 7:25. In this crucial part, Rana Khalil constructs a CASE WHEN statement in PostgreSQL. She first tests a known TRUE condition: WHEN 1=1. The response is delayed. She then tests a known FALSE condition: WHEN 1=0. The response is immediate. This proves she has a reliable mechanism for asking any true/false question and getting a clear answer based on the response time.

By mastering this conditional delay technique, you now have a universal method for blind SQL injection that works even on the most uncommunicative applications.

Conclusion

In this lesson, you've added a critical technique to your manual SQL injection toolkit. When an application provides no feedback through errors or content changes, time-based injection allows you to establish a channel of communication by measuring server response times.

Key Takeaways:

  • When to Use: Time-based blind SQL injection is your method of choice when the application shows no discernible difference in its response, regardless of whether an injected query is syntactically correct or logically true/false.
  • Database-Specific Functions: The ability to cause a delay depends on functions specific to the target DBMS, such as pg_sleep() for PostgreSQL, SLEEP() for MySQL, and WAITFOR DELAY for SQL Server.
  • Payload Structure: A successful injection requires correctly terminating the existing query logic (e.g., with a single quote) and commenting out the remainder of the original statement to avoid syntax errors.
  • Conditional Logic is Key: The ultimate goal is to move from unconditional delays to conditional ones using CASE or IF statements. This transforms the time delay into a tool for asking true/false questions, forming the basis for data exfiltration.

In our next lesson, we will combine the conditional time-delay method you've just learned with the character-by-character extraction logic from our previous lesson on Boolean-based attacks. You will see how to use functions like SUBSTRING and ASCII within a time-based payload to systematically extract sensitive data, one character at a time.