I came along this blind SQL injection time based payload and I need to understand how it works

  • Depending on the context it's used in, the /* may be within a quoted string.
    – paj28
    Sep 25 '14 at 16:37

MySQL uses /* */ as a block comment and no code will be executed within this block. What you are looking at is three injections, and only one will execute depending on the query that is augmented with this SQL injection attack. This is an efficiency hack to speed up the process of fuzzing a website for SQL Injection.

If the injection point doesn't use quote marks, then the first sleep payload will execute and comment out the rest of the injection:


if the injection point is using single quote, then the 2nd payload will execute:


Finally, if the query is using double quotes, then the 3rd and final payload will execute:


Aren't compounded injections neat?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.