Why isn't recommended to use time-based blind for bruceforcing table/column names?

Question

When not having priveleges on the session user you're using with sqlmap this warning appears when trying to retrieve table/column names, offering you to brute force names using a dictionary file,

do you want to use common column existence check? [y/N/q] y
[03:37:06] [WARNING] it's not recommended to use 'AND/OR time-based blind' and/or 'stacked queries' for common column existence check
are you sure you want to continue? [y/N] 

Why isn't it recommended?

Answer 1

This is the condition that causes the warning to be shown:

if kb.columnExistsChoice is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct:

The individual conditions mean:

• kb.columnExistsChoice is None – previous answer to the subsequent question "are you sure you want to continue?"
• not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) – whether there is no other injection using a technique other than time-based or stacked
• not conf.direct – whether it’s not a direct connection

So in conclusion, the warning is shown if

• it hasn’t been shown yet, and
• there is no other injection using a technique other than time-based or stacked, and
• it is not a direct connection.

The reason for that is probably because the time-based and stacked techniques are time consuming and may take quite a time to finish.