This article (PDF) talks about a blind injection technique based on heavy queries.
Can anyone explain to me the purpose of using heavy queries while compared to normal time-based techniques? Is perhaps that, when stored procedures and benchmark functions are disabled, is resorting to heavy queries the only way to perform a bit of vulnerability investigations?
With reference to MySQL, the fact it takes 30 seconds what does it mean? My reasoning is: if it takes 30 seconds so the injected query (heavy query) can be executed so since the query was tailored specifically for MySQL the database platform is MYSQL. But what about the negative result?
Am I right in saying that the heavy query approach is used only to retrieve information about the database platform? It's actually another way to get that kind of information. Other methods deal with Benchmark aand sleep function (MySQL).