BERRY9 IT Services, home +91 86868 92922

Detecting Blind SQL Injection Without Output

Most SQL injection left in modern applications is blind — the response does not echo the query result, so the attacker (and the tester) has to infer it from response differences. Two flavors: boolean-blind (response differs depending on the truth value of an injected condition) and time-blind (response delay depends on the truth value). Here is how we work through both.

Request a scoping call Call +91 86868 92922

Web applications · By Thimmagurudu Bathini · Published · 6 min read · Last reviewed

The discovery sequence

Testing starts with the cheapest payloads. A single quote, a backslash, a semicolon. If the response status or length changes, we move to confirmation:

?id=1 AND 1=1     → normal response
?id=1 AND 1=2     → different response  → boolean-blind candidate

?id=1; SELECT pg_sleep(5)--  → 5 second delay → time-blind candidate

From confirmation we move to extraction. Boolean-blind is faster but needs a response-side oracle; time-blind always works but is slow. Database fingerprinting comes first: @@version, version(), pg_sleep vs WAITFOR DELAY vs SLEEP() — each picks out a different RDBMS.

Things that look like blind SQLi but are not

Cache hit/miss differences, load-balancer flakiness, rate-limit kicking in, search relevance ordering that ranks zero-result queries differently. A finding should be validated with at least three different boolean comparisons before it is declared.

Defending

Parameterized queries everywhere. Where dynamic identifiers are required (ORDER BY column, table name), use a strict allowlist. Web application firewalls catch obvious payloads; they will not stop a careful blind extraction. The bug needs to be removed at the source.

Modern vector survey in SQL injection in 2024; we cover both in web app VAPT.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp