What is a blind (inferential) SQL injection attack?

No data comes back at all — the attacker asks true/false questions and reads the answer from how the app behaves (timing, errors, page differences).

* In-band vs blind SQLi — in-band returns the data in the same response; blind returns nothing and the attacker infers it bit by bit from behaviour. *

Blind (inferential) injection is what you fall back to when the parameter is injectable but the application never shows you the result. Instead of reading the data, you turn the query into a yes/no oracle: phrase a guess as a condition, fire the request, and see whether the application behaves differently. Each request buys one bit.

Three ways to make the difference observable, chosen by what the attacker can actually see:

• Conditional — works when the attacker has an account, so there is a visible result that changes: …where username='Admin' and substring(Password,1,1)='e' --. Row returned means the guess was right.
• Time-based — the fallback when the attacker has no account and nothing visible changes: make the database stall on a true condition. …and substring(Password,1,1)='e' and sleep(10) --. A ten-second page is the "yes".
• Error-based — force a condition-dependent error, e.g. select case when (… substring(password,1,1)='e') then 1/0 else null end: the division-by-zero fires only when the guess is right.

Exact syntax varies by database engine (SLEEP() in MySQL, WAITFOR DELAY in SQL Server), so a real attack starts by fingerprinting the backend.

Why this is more than a curiosity: one bit per request sounds hopeless, but it is trivially scriptable — a loop over character positions and alphabets reads an entire password, then an entire table, character by character. Blind is slower than in-band, not weaker. That is also why "the page shows no error and no data" is never a defence.

Go deeper:

• PortSwigger — Blind SQL injection — conditional, time-based and error-based techniques, each with a lab.