1

Suppose I am fuzzing for SQL injections, instead of trying all other approaches (error-based, boolean-based, union-based, stack-based), would telling my engine to only look for time-based discover all of them? For example: sqlmap -u URL --batch --technique=T

I am under the impression that time-based would find all SQLi (unless the server is specifically filtering out SLEEP or WAITFOR but not AND which would not really happen) and when found one should then try and find a quicker extraction method (look for boolean-based after already seeing that it is time based injectable). Or that the other methods are tried first because they are quicker to test.

  • Remember that time-based SQLi is the most error-prone. – Arminius Mar 14 '17 at 19:48
  • The sleep command has only been in available in MySQL since MySQL 5 IIRC, so based on that alone I would say the answer to your question is no. – DKNUCKLES Mar 14 '17 at 19:50
2

There are definitely exceptions. While sleep may eg work for injections into order by, it doesn't work easily in limit:

select * from pages limit 1,sleep(1); // doesn't work

Obviously, you can still formulate an injection which contains sleep, but I'm guessing sqlmap doesn't have it as default when scanning.

You would also miss injections where the server filters all SQL keywords but still allows inputs like ' -- -.

As noted in the comments, it will also not work if the DBMS does not support a sleep-like function or if you are using the wrong function.

It will also be rather slow (which may or may not be fine) and error-prone (sometimes requests just take some time, especially if you are sending out a lot at a time).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.