question regarding sleep injection

[crossedz]

Hi, I had a particular website where when i inject and sleep(1) it then delays for around 7 seconds, if i do sleep(2) it delays for 14 seconds, if i do sleep(3) it delays for 21 seconds.

I believe this has to do with a load balancer, so my question is, how can i optimize sqlmap to deal with such a target?

Thanks :).

[stamparm]

sqlmap will automatically deal with it, if you are worrying about whether sqlmap will recognize the delay or not.

but, sqlmap can't do fractional second delays. so, all in all, you'll wait a bit longer, but sqlmap should be able to SQLi it.

p.s. that doesn't have to do anything with load balancing. it can be some kind of JOIN query or WHERE..OR conditional statement

[crossedz]

"p.s. that doesn't have to do anything with load balancing. it can be some kind of JOIN query or WHERE..OR conditional statement"

Hm, i don't get what you mean, how would having a WHERE statement increase the response from the server proportionally to the number of seconds specified in sleep?
I would like to know the explanation behind that, and thanks a lot for the lightning fast response :D.

[stamparm]

There is a big difference between:

A) SELECT 1 FROM table WHERE <cond1> AND SLEEP(1)
and
B) SELECT 1 FROM table WHERE <cond1> OR SLEEP(1)

where SLEEP(1) is injected SQLi. That B) will potentially execute SLEEP(1) for every False evaluation of <cond1> (because that's what's OR for), depending on DBMS and query optimization engine itself

[crossedz]

Alright, this one is so so so odd though.

When i run OR sleep(1)--+ it does nothing, only thing i can see working is and sleep(1)--+, true and false statements do absolutely nothing.

I tried and if(1=1),SLEEP(5)--+ but i wasn't getting any results, isn't that syntax correct?

I want something like
(true statement, therefore sleep(1)):
if(1)=1 then sleep(1)--+

and then a false statement like so (so it doesn't sleep(1) and loads instantly):
if(2)=44 then sleep(1)--+

So i can then form my query to extract information appropriately.

Thanks a lot :D.

[crossedz]

forget about it, i solved it. Thanks for the help anyway, much appreciated.