Skip to content

Add async mechanism for time-based blind SQLi#6028

Closed
Saudadeeee wants to merge 1 commit intosqlmapproject:masterfrom
Saudadeeee:feature/async-time-based-sqli
Closed

Add async mechanism for time-based blind SQLi#6028
Saudadeeee wants to merge 1 commit intosqlmapproject:masterfrom
Saudadeeee:feature/async-time-based-sqli

Conversation

@Saudadeeee
Copy link

Implements experimental asynchronous bisection for time-based blind SQL injection using aiohttp. Adds CLI options (--async, --async-time-based) to dramatically improve extraction speed by running binary search requests concurrently, while gracefully falling back to synchronous execution if dependencies are missing

@stamparm
Copy link
Member

stamparm commented Mar 11, 2026

Thank you for the effort, but sqlmap already natively supports concurrent time-based extraction via the --threads flag, which intentionally prompts a warning because parallelizing time delays inherently causes database starvation and false positives. We will not introduce a bloated third-party dependency like aiohttp to completely bypass our core request engine and reinvent a fundamentally unstable wheel.

you are even presented with a prompt when using --threads and time-based SQLI:

multi-threading is considered unsafe in time-based data retrieval. Are you sure of your choice (breaking warranty) [y/N]

This architectural decision is final; we consider this matter closed and will not entertain further debates or pull requests attempting to force concurrent network I/O on time-based payloads.

@stamparm stamparm closed this Mar 11, 2026
@stamparm stamparm self-assigned this Mar 11, 2026
@sqlmapproject sqlmapproject locked as resolved and limited conversation to collaborators Mar 11, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants