Lab: Blind SQL injection with time delays
Summary: This PortSwigger lab presents a blind SQL injection vulnerability in an application that stores a tracking cookie value and runs it in a synchronous SQL query. Because the application returns no query results and responds identically whether the query returns rows or errors, the lab requires exploiting conditional time delays to infer information and cause a 10 second delay.
Why it matters: The application's identical responses to success and error hide the injection from casual observation, so the only signal left is response timing - a channel that a 10 second delay proves is open to anyone who can set the cookie.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026