Are all SQL injections exploitable through time-based attacks?

Question

Suppose I am fuzzing for SQL injections, instead of trying all other approaches (error-based, boolean-based, union-based, stack-based), would telling my engine to only look for time-based discover all of them? For example: sqlmap -u URL --batch --technique=T

I am under the impression that time-based would find all SQLi (unless the server is specifically filtering out SLEEP or WAITFOR but not AND which would not really happen) and when found one should then try and find a quicker extraction method (look for boolean-based after already seeing that it is time based injectable). Or that the other methods are tried first because they are quicker to test.

Answer 1

There are definitely exceptions. While sleep may eg work for injections into order by, it doesn't work easily in limit:

select * from pages limit 1,sleep(1); // doesn't work

Obviously, you can still formulate an injection which contains sleep, but I'm guessing sqlmap doesn't have it as default when scanning.

You would also miss injections where the server filters all SQL keywords but still allows inputs like ' -- -.

As noted in the comments, it will also not work if the DBMS does not support a sleep-like function or if you are using the wrong function.

It will also be rather slow (which may or may not be fine) and error-prone (sometimes requests just take some time, especially if you are sending out a lot at a time).