SQL injection with filter bypass via XML encoding

Blind SQL injection with out-of-band data exfiltration

Blind SQL injection with no readable feedback at all, solved by smuggling the administrator's password out through a DNS lookup, hiding the stolen data inside the domain name itself using an XXE-driven subquery

Blind SQL injection with out-of-band interaction

Blind SQL injection with zero visible feedback, no errors, delays, or content differences to read, solved by pairing SQLi with an XXE trick to force an Oracle database into making a DNS lookup to Burp Collaborator

Blind SQL injection with time delays and information retrieval

Blind SQL injection with no visible errors or response differences, solved purely by timing the database's own hesitation - using pg_sleep as a true/false switch and a single-threaded Burp Intruder attack to read the administrator's password one clock tick at a time

Visible error-based SQL injection

Error-based SQL injection that forces the database to leak data through its own type conversion errors - casting subquery results to int, fighting a cookie length limit, and reading the administrator's credentials straight out of the error message.

Blind SQL injection with conditional errors

Blind SQL injection exploited through conditional errors - fingerprinting an Oracle database with dual, turning divide-by-zero into a true/false oracle, and automating Burp Intruder to extract the administrator's password one character at a time

Blind SQL injection with conditional responses

Blind SQLi through the TrackingId cookie a single conditional message drives length checks and a SUBSTRING brute force until all 20 characters of the password fall out