blind time-based sql injection
Extract data one bit at a time when the application reveals nothing in its response. We use SLEEP() as a side-channel and write a small Python harness to automate the extraction.
A blind time-based SQLi works when the application gives you no observable output, no error
messages, and no boolean differences in the response. Your only signal is how long the
response takes. Inject a conditional SLEEP() and you can read out the database one bit at
a time.
setup
The lab ships as a Docker container with a vulnerable Flask app and a SQLite backend. Spin it up with typhon-mcp, or use the manual setup if you don't have it installed.
manual setup
The full setup walkthrough is coming with the video. For now, the gist:
Then visit http://localhost:8080/?id=1 — the only injectable parameter is id.
the vulnerability
The application runs the query:
query = f"SELECT name FROM users WHERE id = {user_input}"No quoting, no parameterisation. We can't see the result. We can't see errors. But we can see time.
walkthrough
Walkthrough video coming soon. Until then, the canonical primer is the PortSwigger labs.
// share