Blind SQL Injection is based on TRUE/FALSE tests. Here is an example:

is first letter A? --> NO
is first letter B? --> YES
is second letter A? --> NO
is last letter X? --> YES

It's not a fast method. Do you know something better to guess the word from the database faster?

  • Try error based SQL injection. It can read DB values and parameters as a complete word.
    – Majoris
    Commented Jun 12, 2012 at 14:34
  • 2
    This is a really poorly worded question. It is not clear what you are asking. If you are guessing, then use brute force. If you want to extract data, then you are looking at Bsqli or error-based.
    – schroeder
    Commented Jun 12, 2012 at 14:39
  • @FirstnameLastname Isn't BSQLi the same as Error-based except that you don't get an overt error message?
    – schroeder
    Commented Jun 12, 2012 at 14:55
  • @Firstname Lastname depends on the db, that doesn't work for mysql.
    – rook
    Commented Jun 12, 2012 at 18:35

4 Answers 4


Your approach to this problem is very bad. You are trying to find letters in the linear time complexity: O(n). Comparing letters, one after the other. It means, that in the pessimistic model you have to check the whole alphabet. Let’s assume that your alphabet consists of only lower-case letters: {a,z}, and your password is zzz. You will have 26 tries to find the first letter, 26 tries to find the second letter and 26 tries to find the last one.

As it was mentioned above, you can speed up this process. Please notice, that the order of letters in the alphabet is always the same (letters are sorted). You can use binary search with O(log(n)) time complexity. This method is used by most people. However, you can speed it up too.

If we know, that the searching password is the dictionary-word, we could use linguistic analysis to build our blind sql injection tries. We could use our knowledge about the frequency of letters in text (for example, the most frequent letter in English is ‘e’). We could also use the knowledge: what’s the probability that after letter X, letter Y occurs. We could also try to guess how many letters X are in our word. In this approach regular expressions can help us a lot. We define the range of characters that will be matched by LIKE (for MSSQL) or REGEXP (for MySQL) functions. Pretty nice explanation about regular expression in sql injection attacks could be find here: http://www.ihteam.net/papers/blind-sqli-regexp-attack.pdf

  • regular expressions are nice idea - that is what I asked about.
    – Mark Q.
    Commented Jun 15, 2012 at 17:48
  • Is binary search really faster for a time-based SQLi? With a linear search, you need more requests, but the sleep method is only called when the characters match, so only once per character. You could also sort the characters by average frequency depending on the context. With a binary search, the sleep method is on average called log(n)/(2*log(2)) per character, which is always more often.
    – Volker
    Commented Dec 3, 2015 at 9:24

The method you are describing has an O(n) time complexity. You can use a binary search which has an O(log(n)) time complexity. I believe sqlmap uses a binary search, there are a number of other implementations.

Some databases like MSSQL allow you to perform DNS lookups, and this can be used as an alternate communication channel with the database.

You can also dump the results of a query to a file using MySQL's into outfile.

Finally sometimes its not actually blind injection, just "hard of seeing". What I mean by that is that you don't need to use sleep() and you can't pull data out directly with a union select, but rather if a part of the query is false or true it affects some part of the page. I used this exploitation technique in simple machines form, where by if the question was true, then a record was found, if it was false then I would get an error "No Messages Found". This can be used along with a binary search to greatly speed up the process of Exfiltrating Data.


You can do your own tests with sqlmap, which includes different types of SQLi attacks.

Because you don't include any environment information, I'm not sure how else to help. Run sqlmap using one type of sqli and compare running times, taking into account variables that might artificially inflate run times.


Do case insensitive, and break it in to chunks...

Does current chunk contain any A's?

WHERE MID(field1,1,40) LIKE '%a%'

If so:

WHERE MID(field1,1,40) LIKE 'a%'
WHERE MID(field1,1,40) LIKE '_a%'
WHERE MID(field1,1,40) LIKE '__a%'


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .