Field Notes #04 — The Silent Database: Time-Based Blind SQL Injection

Field Notes is the P01yg107 Labs lab journal — real offensive-security techniques, broken down by the person who builds the hardware. Authorized labs and CTFs only.

Temporal inference — feeling for data you can't see

When the server tells you nothing, you make it tell you time. This portal was wired to delay its response about 3 seconds when a query condition was true. That delay is your oracle.

• Stopwatch: curl -w "%{time_total}".
• Yes/No questions: “Does the flag start with ‘A’?” → instant (false). “…start with ‘C’?” → 3-second delay (true).
• Optimize: a binary search over ASCII values narrows each character fast — the whole flag in minutes, not hours.

The fix — separate data from code

Hiding errors doesn't help; that's security by obscurity. The real fix is parameterized queries (prepared statements): the template goes to the database first, the user data goes separately, and the engine is told “this is a value, never code.”

# Vulnerable — input concatenated straight into the query
query = f"SELECT * FROM users WHERE username = '{username}'"

# Safe — placeholder; data passed separately as a parameter
cursor.execute("SELECT * FROM users WHERE username = ?", (username,))

Takeaway: hiding your errors is a “No Trespassing” sign on a glass door — it hides the view, it doesn't stop the brick. Parameterize every input.

Why this lives on a hardware store

Because the mindset is the product. The gear we build exists to help you find exactly these gaps on systems you're authorized to test — understand the attack, and you can build it, break it, and defend it. Every P01yg107 unit is hand-built, flashed, and tested by me, an active bug-bounty researcher and CTF author. Verify me →

Authorized testing & education only. Every technique here was performed against an isolated lab I built or am authorized to test. Don't touch systems you don't own or have permission to test. — Josh, P01yg107 Labs · TryHackMe · CTF source