Blind SQL Injection

Extract secrets when the app hides errors and never shows extra query rows

15 min+56 XP

Module progress3 of 6

Visual · web_developer

Blind SQLi asks yes/no questions to the database—one bit of information at a time—until full secrets emerge.

Opening

No errors? No extra rows? Still game over.

Modern apps often suppress database errors and never display raw query output. Attackers switch to blind SQL injection: they infer answers from tiny differences—a page that loads vs. one that 404s, a “Welcome” vs. “Invalid,” or a response that takes five seconds instead of one.

1. Boolean-Based Blind SQLi

The attacker injects conditions that make the query TRUE or FALSE. The HTTP response changes subtly—different body length, missing element, or alternate message—revealing one bit per request. Automated tools (sqlmap in authorized labs) chain thousands of these questions to dump entire tables.

Boolean blind concept (lab DVWA)Welcome back AND SUBSTRING(password,1,1)= -- " "# FALSE might show " "id=1z

Welcome back AND SUBSTRING(password,1,1)= --

"
          "# FALSE might show 
"
          "id=1z

2. Time-Based Blind SQLi

When the page looks identical either way, attackers add a delay tied to a condition. If the database sleeps for five seconds, the condition was true.

Time-based probe (MySQL lab example) AND IF(SUBSTRING(user(),1,1)=, SLEEP(5), 0) -- " "# Response took ~5s → first char of current DB user is

AND IF(SUBSTRING(user(),1,1)=, SLEEP(5), 0) --
"
          "# Response took ~5s → first char of current DB user is

← Previous

Guest mode — log in to track XP