treat timeout as valid response

[BluBb-mADe]

Is it possible to treat a timeout as a valid false or true response in the detection phase for bool blind?
If not then you can see this as feature request for a switch.
Use case:
<? mysqli_query($con, $query) or sleep(60) and exit();

[stamparm]

But, even time-based blind (which would be most probably recognized in your case) is more usable than your proposition. In time-based blind SLEEP-time will go by default to 5-seconds. So, I am pretty sure that everybody would skip the usage of timeouts for recognition of boolean-based blind.

Also, your "bool blind" case works only if the error is triggered for either TRUE or FALSE. In empty results (like e.g. for simple cases with AND 1=0) that sleep(60) would not be triggered AFAIK. Only in case of errors. So, you are assuming that neither time-based blind nor regular boolean-based blind works in your case and that error-triggered boolean-based blind is the only way to exploit the target. If I would need to wait for timeouts to recognize TRUE from FALSE result I would definitely try to find another way.

[stamparm]

I can put a --ignore-timeout (even if I know that it will be rarely used, if any), but I am not willing to make a distinguish of boolean-based blind based on timeouts. There should be any kind of non-time based difference. For blind SQLi based on time-comparison there are time-based payloads (where timeouts are ignored by default)

[BluBb-mADe]

It seems you misunderstood what I wanted to ask for.
I'm not talking about the actual data retrieval but about the detection phase.
In my example sqlmap would need 60 seconds per try while looking for a weakness.
In some cases that could mean that it would take days to get a simple scan done because sqlmap would have to wait forever for every failed injection attempt.
But if you could specify that a timeout should be considered a bool blind false result you just could adjust the timeout to a good value and save maybe over a minute per request.
There are multiple solutions for this problem that I can think of on top of my head but my proposal would be an easy one.

[stamparm]

I believe that you've misunderstood what is the meaning of "bool blind false result". False result is actually a VALID response to a VALID SQLi (e.g. 1 AND 1=0).

You wanted actually to ignore timeouts. This has nothing to do with "bool blind false result"

[BluBb-mADe]

You are right, I guess an ignore-timeout flag could do the trick but its still not quiet clear to me how that would actually behave.

[stamparm]

It seems that we are not on a same wave-length here. Can you please concentrate on that last message I wrote?

[BluBb-mADe]

There should be any kind of non-time based difference.

That's the point, if you need a response to decide the result and your request causes an error you'll get stuck in the delay for every "false" request even if you get a valid response eventually.

[stamparm]

Can you then please explain what's wrong my reply to you I can put a --ignore-timeout (even if I know that it will be rarely used, if any), but I am not willing to make a distinguish of boolean-based blind based on timeouts?

[stamparm]

Also, one thing, I've said to you that in those kind of cases time-based blind is actually a FAR better choice (5 seconds delay vs 60 seconds delay).

[stamparm]

Closing this down because we are not going in right direction here