Yes, that's one way to extract data by (ab)using a blind sql injection vulnerability. If you look at sqlmap [1], they offer two techniques for blind sql inject

Yes, that's one way to extract data by (ab)using a blind sql injection vulnerability. If you look at sqlmap [1], they offer two techniques for blind sql injection: boolean-based and time-based. Boolean-based should be used when the app just returns an error page (or not) based on your sql injection. The time-based approach should be used when no error page appears but the SQL is still executed. But when I look at sqlmap docs for the time-based approach [2] I think I got the initial explanation wrong. It will do a 5 second delay if a certain condition is met, e.g. "Is the first character of the value an 'T'? If yes, wait 5 seconds; if not, return immediately". And then send hundreds of requests in parallel to iterate over all positions & possible characters. [1] https://github.com/sqlmapproject/sqlmap/wiki/Usage#sql-injection-techniques-to-test-for https://github.com/sqlmapproject/sqlmap/wiki/Usage#sql-injec... [2] https://github.com/sqlmapproject/sqlmap/wiki/Usage#seconds-to-delay-the-dbms-response-for-time-based-blind-sql-injection https://github.com/sqlmapproject/sqlmap/wiki/Usage#seconds-t...