Username enumeration via response timing

🎯 Objective

Validate and detect SQL injection by leveraging time-based behavior in a back‑end web service.

🧭 Scope / Setup

• Tooling: Burp Suite (Proxy, Repeater, Intruder)
• Target: Lab service with a query endpoint that supports time/delay logic
• Precondition: Session established; traffic proxied through Burp

🔎 Approach

1. Intercept the target request in Burp Proxy and send to Repeater.
2. Append a time-delay payload to the parameter suspected to be vulnerable (e.g., sleep, pg_sleep, BENCHMARK/WAITFOR DELAY, DBMS_LOCK.SLEEP depending on DB).
3. Compare response times between baseline and injected requests.
4. If deterministically slower, proceed to enumerate further (columns, boolean conditions, exfiltration).

🧪 Test Payloads (database dependent)

• PostgreSQL: '||pg_sleep(5)-- or ';SELECT pg_sleep(5)--
• MySQL: '||SLEEP(5)-- or ' UNION SELECT 1,2,3 WHERE SLEEP(5)--
• MSSQL: '; WAITFOR DELAY '0:0:5'--
• Oracle: '||DBMS_LOCK.SLEEP(5)--

Tip: Start small (2–3s), verify repeatability (≥3 trials), then tune. Use Burp Repeater timing panel or Logger++ for precise measurements.

✅ Outcome

• Confirmed/ruled out time-based SQLi by comparing baseline vs. injected response latency.
• No screenshots were captured for this simple timing check in this lab.

🛡️ Mitigations

• Use parameterized queries / prepared statements.
• Enforce strict input validation & output encoding.
• Centralize DB access with vetted query builders/ORMs.
• Add WAF only as defense-in-depth (not a primary control).

📝 Notes

• Time-based tests can be noisy; keep payloads minimal and run outside peak load.
• False positives can occur due to network jitter—confirm with multiple trials and boolean conditions.