skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

sql-injection-blind

Exploit blind SQL injection using boolean, time-based, and out-of-band techniques.

253|37|Updated Feb 22, 2026
Search Tags:#sql injection#penetration testing#web security#vulnerability exploitation#blind sqli#oob exfiltration
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill sql-injection-blind
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sql-injection-blind
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/sql-injection-blind
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill sql-injection-blind

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sqlmap, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill enables penetration testers to identify and exploit blind SQL injection vulnerabilities in web applications, where direct output or errors are not visible.

Core Features & Use Cases

  • Boolean-Based Exploitation: Detects vulnerabilities by observing differences in application responses to true/false SQL conditions.
  • Time-Based Exploitation: Exploits vulnerabilities by measuring deliberate delays in server responses.
  • Out-of-Band (OOB) Exploitation: Exfiltrates data via DNS or HTTP callbacks when other methods fail.
  • Use Case: A penetration tester suspects a blind SQL injection in a login form parameter. They use this Skill to confirm the vulnerability and extract database table names and user credentials indirectly.

Quick Start

Use the sql-injection-blind skill to test the 'id' parameter on 'http://example.com/page?id=1' for time-based SQL injection.

Frequently Asked Questions about sql-injection-blind

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit blind SQL injection when the application returns no database errors?▼

To exploit blind SQL injection without visible errors, this Skill uses boolean-based, time-based, and out-of-band techniques to infer data by analyzing server response delays or differences in application behavior to manipulated SQL queries.

What is the best way to extract database tables using blind SQLi?▼

The best way to extract tables using blind SQLi is by using inferential techniques like boolean conditions or time-based delays to systematically exfiltrate DBMS-specific data character by character.

Does this sqlmap skill support out-of-band data exfiltration?▼

Yes, this Skill supports out-of-band data exfiltration, allowing you to extract database information via DNS or HTTP callbacks when boolean-based and time-based blind SQL injection methods fail.

How do I test a URL parameter for time-based SQL injection?▼

You can test a URL parameter for time-based SQL injection by using this Skill to inject deliberate SQL delays into the target parameter and measuring the server's response time to confirm the vulnerability.

When should I use boolean-based versus time-based SQL injection techniques?▼

Use boolean-based SQL injection when the application shows visible response differences to true or false conditions, and switch to time-based techniques when the application returns identical responses to inferential SQLi queries.

Do I need to confirm an injection point before using this penetration testing skill?▼

Yes, you must confirm an existing injection point and have a clear understanding of the target DBMS-specific syntax before using this Skill for authorized vulnerability exploitation and data extraction.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
34

SQL Injection Testing

Detect and exploit SQL injection vulnerabilities in web applications.

Community
Advanced
chainreactorschainreactors
235

zombie

Automates weak credential detection across network services using aiscan.

Official
Intermediate
Chid0kChid0k

sqli-detect

Detect SQL injection vulnerabilities by analyzing input parameters and response behaviors.

Community
Advanced
zebbernzebbern
4.5k

SQLMap Database Penetration Testing

Automate SQL injection detection and exploitation with SQLMap.

Community
Advanced