Introduction

The application does not display the SQL query results or any error messages, but it does return a distinct and specific response when the…

The website application does not return query results but instead reveals information through an error response

A time delay can be triggered to determine the outcome of the query

The SQL query does not return any visible response, but it can trigger an out-of-band interaction that delivers the result through a…

Two real SQLi vulnerabilities found during bug hunting — both out of scope, both reported anyway

Expectation vs. Reality

Hello readers 😄😄😄

Hi, I am HV (Harsh Vardhan) a Security Researcher. So, that’s it about me.

Error-based SQL Injection

Extracting sensitive data via verbose SQL error messages

This is a walkthrough of the portswigger lab: Blind SQL Injection With Conditional Errors.

Exploiting Blind SQL Injection by Triggering Time Delays

The previous SQL injection lab gave me everything directly — table names, column names, passwords all visible in the response. This one…

This is the walkthrough of portswigger lab: Blind SQL injection with time delays and information retrieval.

SQL Injection is one of the classic web application security vulnerability, and Blind SQL Injection takes the same underlying weakness a…

General tips

PortSwigger Web Security Academy Lab

Time-based blind SQL injection is one of the most reliable techniques when no data is reflected in the response. Instead of seeing output…

Section: 01 — Lab & Objective: