There is another kind of blind injection, which is called time-based Blind SQLi, in which we don't have a visual clue whether or not the command was executed (as in valid or invalid account messages). Instead, we need to send a sleep command to the database and, if the response time is slightly longer than the one we sent, then it is a true response. This kind of attack is slow as it is sometimes necessary to wait even 30 seconds to get just one character. It is very useful to have tools such as sqlninja or SQLMap in these situations (https://www.owasp.org/index.php/Blind_SQL_Injection).

Have a look at the following links for more information on Blind SQLi:

• https://www.owasp.org/index.php/Blind_SQL_Injection
• https://www.exploit-db.com/papers/13696/
• https://www.sans.org/reading-room/whitepapers/securecode/sql-injection-modes-attack-defence-matters-23