SCENARIO:
a vulnerable login form. I say vulnerable because if I enter +select(sleep(0))+ the server response normally. If I enter +select(sleep(5))+ the server wait for a period of time greater than 5" and then responds with "connection failed". Can be this considered a proof of SQL injection?
Could I leverage this difference in the responses to conditionally extract data from the db?
The high-level idea is:
if user(1,1) is 'a' then sleep(0) else sleep(1)
Does the connection time out at approx. 5 seconds? If so, then it is very likely vulnerable. You could verify by then modifying it to 3 seconds, and seeing if it responds in approx. 3 seconds.
If the connection takes longer than 5 seconds, it is possible this is a very strange SQL query, or there is a WAF or some other functionality detecting blacklisted keywords. They may be throwing you a red herring! It's happened to me before in this exact situation during a manual engagement.
Can be this considered a proof of SQL injection?
This definitely is proof of SQL injection. Specifically, this is Blind SQLi where you are using functions such as sleep() to confirm the presence of information in the database.
Could I leverage this difference in the responses to conditionally extract data from the db?
As schroeder put it, it is worth using automatic tooling for blind SQLi.
For more information on Time-Based Blind SQL Injection Attacks, also refer to https://www.sqlinjection.net/time-based/
