Time-based blind SQL injection determines whether a query is successful by using delays such as SLEEP(x), where a delayed response indicates a true condition and no delay indicates a false condition.

So, for example, when trying to establish the number of columns in a table, you would use the following query:

admin123' UNION SELECT SLEEP(5);--

If there was no pause in the response time, we know that the query was unsuccessful, so like on previous tasks, we add another column:

admin123' UNION SELECT SLEEP(5),2;--

This payload should have produced a 5-second delay, confirming the successful execution of the UNION statement and that there are two columns.

You can now repeat the enumeration process from the Boolean-based SQL injection, adding the SLEEP() method to the

UNION SELECT

statement.

If you're struggling to find the table name, the below query should help you on your way:

referrer=admin123' UNION SELECT SLEEP(5),2 where database() like 'u%';--