Time Based

Theory

Time-based SQL injection is a technique that relies on sending an SQL query to the database which forces the database to wait for a specified amount of time (in seconds) before responding. The response time will indicate to the attacker whether the result of the query is TRUE or FALSE.

Practice

The process is relatively the same as Boolean Based injection. All you have to do is modify the payloads to force the database to wait.

MySQL

A time-based SQLi payload in MySQL will look like this

1'; SELECT IF(YOUR-CONDITION-HERE,SLEEP(10),'a')-- -

Examples:

#Boolean Based  
1' AND (SELECT LENGTH(database()))=1-- -

#Time Based  
1'; SELECT IF((SELECT LENGTH(database()))=1,SLEEP(10),'a')-- -

MSSQL

OracleSQL

PostgreSQL

SQLite