4 ms·

I haven't seen the BENCHMARK trick before. It's very clever - a variation on timing failed login/password attempts. This is a clear and effective writeup. Cong

I haven't seen the BENCHMARK trick before. It's very clever - a variation on timing failed login/password attempts. This is a clear and effective writeup. Congrats OP.

andypants 12y ago
> It's very clever - a variation on timing failed login/password attempts. Can you explain? To me it just looks like a way to prove the exploit exists without revealing any actual injections.
- 1c4050b09 12y ago
  It's a pretty common technique for exploiting Blind SQLi. You can use this as the one of the Branches in a SELECT IF to be able to determine the value of something in the DB. https://www.owasp.org/index.php/Blind_SQL_Injection#Time-based https://www.owasp.org/index.php/Blind_SQL_Injection#Time-bas...