I am part of a team which developing web app penetration testing framework, and I am taking care of SQLi detection. When I tested multiple known vulnerable local sites found Boolean Blind flaw always occur with Time Blind flaw. I want to know is my conclusion is correct or is there a situation where a Boolean Blind can occur without Time Blind?
Whilst I don't think I can provide a concrete example my inclination would be to say that it is possible that there would be an instance of SQLi where boolean based injection would be possible and time-based would not.
The reason being that time-based injection usually relies on modifying the syntax of the query to add additional statements (e.g. WAITFOR DELAY) which may not be supported in every part of a query in every DBMS, whereas boolean based injection relies on inserting logical operators which are more likely to be universally supported.
There are two terms that we are talking about here:
- Boolean Blind : In this technique, we aim to detect sqli by passing values into the input parameters which will return true or false. For eg, if I give the input as 10=10 or A||B, then the application will return the results after executing that expression. If it does, then it is vulnerable to SQLi.
- Time Blind: This is used to detect vulnerablity by forcing the application to wait for some time and then return the results. Fo eg, WaitFor Delay.
Both the above techniques are a part of Blind SQL Injection technique.