Intermediate LevelWeb Security & Cyber Defense
What is Blind SQL Injection (Boolean-based and Time-based) and how do attackers extract data?
❓ Interview Prompt: Explain Blind SQL Injection, Boolean-based blind SQLi, Time-based blind SQLi (`pg_sleep()`, `WAITFOR DELAY`), and automated extraction with sqlmap.
Blind SQL Injection occurs when an application is vulnerable to SQL injection, but does NOT display database errors or query results in HTTP responses:
2 Extraction Techniques:
1
Boolean-Based Blind: Attacker injects boolean tests ('AND SUBSTRING(username,1,1) = 'a''). If page content changes, the letter is 'a'!
2
Time-Based Blind: Attacker injects database sleep commands ('AND pg_sleep(5)'). If response is delayed by 5 seconds, the condition evaluates to true!
•
Automated Tooling: Attackers use 'sqlmap' to extract complete databases character-by-character automatically.
Code Implementation Example
sql
-- Time-Based Blind SQL Injection Payload testing if admin password starts with 'a':
SELECT * FROM products WHERE id = 1 AND IF(SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='a', SLEEP(5), 0);💡Time-based Blind SQL Injection payload using conditional SLEEP delay.
🎯 Interview Key Takeaway
Neutralize Blind SQL Injection by enforcing parameterized queries across all database drivers.
#Blind SQLi#SQL Injection#Database Security#Intermediate
Back to all Web Security & Cyber Defense Questions→