Infer SQL data through boolean or time-based differences
Needs: A stable boolean response difference or controlled DB-specific delay; comparable repeated baseline requests
Choose a stable page marker or content length for true/false comparisons
# Choose a stable page marker or content length for true/false comparisons
' AND SUBSTRING((SELECT version()),1,1)='P'-- -
' AND SUBSTRING((SELECT version()),1,1)='X'-- -
# DBMS-specific time proofs
MySQL: ' AND IF(1=1,SLEEP(5),0)-- -
PostgreSQL: '; SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END--
MSSQL: '; IF (1=1) WAITFOR DELAY '0:0:5'--
Verify → Keep true/false controls, repeated measurements and the exact inferred predicate; a single slow response is inconclusive.
If it fails → Unstable sessions/caching/load can break inference. Fix the channel or choose another verified primitive rather than trusting noisy recovered strings. More detail ↓
Explanation & examples
Infer SQL data through boolean or time-based differences
- USE WHEN
- Query influence exists but rows are not rendered
- STARTING ACCESS
- A reproducible application request and a controlled input or access-context comparison
- RESULT
- Selected database facts recovered through a reproducible inference channel
Recognize the clue
Start from proven query influence and compare stable true/false controls or repeated baseline timings when no rows are rendered.
curl -sk -o /dev/null -w '%{time_total}\n' --get --data-urlencode 'PARAM=BASELINE_VALUE' http://TARGET:PORT/PATH
Repeated baseline: short, stable responses
Predicate TRUE: marker present
Predicate FALSE: marker absentMeans: A repeatable predicate-dependent difference provides an inference channel even without visible rows.
Confirm: Validate controls using a known predicate and separate caching, network load and backend delay.
- After validation
- Known predicates classify consistently and unknown predicates use the same channel: select blind inference.
- Ruled out in this context
- Differences track session/rate-limit noise rather than predicate truth: reject that signal.
- Still inconclusive
- One slow request or random body variation is insufficient; repeat controls or choose another primitive.
Troubleshooting: Unstable sessions/caching/load can break inference. Fix the channel or choose another verified primitive rather than trusting noisy recovered strings.
Choose a stable page marker or content length for true/false comparisons:
DBMS-specific time proofs:
Repeat controls. Time-based results are invalid if application latency overlaps the chosen delay or the condition cannot be changed independently.
Why it works
Boolean and timing channels encode a predicate's truth rather than display data. Timing must separate database delay from network/server noise and rate limiting.
Worked example · hypothetical
Observation: true/false predicates produce different page content. Test: repeat controls and infer one known character before unknown data. Illustrative output: the known predicate is classified correctly. Interpretation: use the validated channel for selected useful fields.
New identity, privilege, host or route? Re-enumerate → All topic tasks →