4 ms·
> It's very clever - a variation on timing failed login/password attempts. Can you explain? To me it just looks like a way to prove the exploit exists without
by andypants 12y ago
> It's very clever - a variation on timing failed login/password attempts.
Can you explain? To me it just looks like a way to prove the exploit exists without revealing any actual injections.
- 1c4050b09 12y agoIt's a pretty common technique for exploiting Blind SQLi. You can use this as the one of the Branches in a SELECT IF to be able to determine the value of something in the DB. https://www.owasp.org/index.php/Blind_SQL_Injection#Time-based https://www.owasp.org/index.php/Blind_SQL_Injection#Time-bas...