> For the complete documentation index, see [llms.txt](https://meitoka.gitbook.io/stash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://meitoka.gitbook.io/stash/learning/sqli/inferential-blind-sql-injection.md).

# Inferential (Blind) SQL Injection

### Boolean-Based

Boolean-based SQL Injection refers to the response we receive from our injection attempts, which could be a **true/false**, **yes/no**, **on/off**, **1/0** or any response that can only have two outcomes.

The goal of this method is to use the <mark style="color:red;">`... like '%';--`</mark> to find database, tables, columns and after it, and potential username and password.

#### Example:

```sql
admin123' UNION SELECT 1,2,3 from users where username='admin' and password like 'a%
```

### Time-Based

Same than Boolean-Based but without visual indicator. So, The indicator will be based on the time the query takes to complete. To perform it, we use the built-in method <mark style="color:red;">`SLEEP(x)`</mark> alongside the <mark style="color:red;">`UNION`</mark> statement.

{% hint style="info" %}
The `SLEEP()` method will only ever get executed upon a **successful** UNION SELECT statement.
{% endhint %}

#### Example:

```sql
admin123' UNION SELECT SLEEP(5),2 where database() like 'u%';--
```