SQL injection with no output

Question

So I found this section of a webpage, which is a basic "feedback box". It had all the characteristics of an SQL injectable element. Scanned it with OWASP, it was true. Tried SQLmap, it gave me connection errors since it was protected.

Since it's an element with no output, only a "thank you" message. How can I test it?

Here's the error message I get when I don't comment out the rest:

La consulta falló: select * from encuestas_new_t where id = '1' and 1=0' and 1=0=1 -- '

When I comment out the rest of the query with -- - it works as if it was the normal default link. What steps would you recommend me to take? Thank you

Answer 1

The standard method for verifying "Blind" SQL injection attacks is the WAITFOR Flow Control element.

WAITFOR DELAY '00:00:5'; - for example, this will wait 5 seconds before returning. Assuming the operation is synchronous with the code, if you see a 5 second delay before a response, you can verify that the injection is working.

You can read more on Blind SQL Injections on the OWASP Website.