Lab: Blind SQL injection with time delays and information retrieval
Summary: This PortSwigger lab presents a blind SQL injection in an application that runs a SQL query against the value of a tracking cookie, returning no query results and giving no different response for rows or errors. Because the query executes synchronously, conditional time delays let an attacker infer data, and the lab's goal is to extract the 20-character password of the administrator user from a users table and log in as that user.
What you should know: The application gives an attacker no error messages and no visible output, yet a 10-second delay in the response is enough to confirm a condition and walk out a 20-character administrator password one character at a time. A cookie used only for analytics was enough to reach a users table holding credentials.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026