Hack Forums
SQLi Time-Based injection Requests are very slow - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: SQLi Time-Based injection Requests are very slow (/showthread.php?tid=6089988)



SQLi Time-Based injection Requests are very slow - SecureHatz - Jun 24, 2020

Hi friends

I infiltrated a site's referrer vulnerability.

[Image: Screenshot-5.jpg]

It takes too long to pull the data. I can pull 1 line of data in about 1 hour.

Is there a way to speed it up?

When I check for WAF, I can't find any results.
Quote:[SUCCESS] no protection identified on target


But after infiltrating from the remote server, I try to infiltrate from my own computer and I get an error. When I try to infiltrate with the same commands I wrote, it is not infiltrated.

If you help, I would appreciate


RE: SQLi Time-Based injection Requests are very slow - SecureHatz - Jun 26, 2020

Can anyone help me? I need some advise


RE: SQLi Time-Based injection Requests are very slow - niqscann - Oct 11, 2020

your connection speed to server should be slow
maybe try --timesec=1 if chars are coming correct than try it


RE: SQLi Time-Based injection Requests are very slow - NeverMore - Oct 11, 2020

nah , its not about Any WAF or protection mechanisms .

its about the injection Type : Time-Based , always slow

In boolean based blind proposed technique(s) require TRUE, FALSE, ERROR and SLEEP responses for 4 different states (unpractical, unrealistic (because of requirement for ERROR state) and slow because of SLEEP). In time-based blind paper requires 4 discreet states (SLEEP 1, SLEEP 2, SLEEP 3, SLEEP 4) while in real life you only get SLEEP or NOSLEEP. You can't distinguish discreet SLEEP states because of implicit/inherent network and/or server latency.