What is the difference between Blind SQL inj and Double Blind?

Question

SQL

Good afternoon.
Prompt the following: there are two types of vulnerability: Blind SQL inj and Double Blind SQL inj.
If the first one was found when checking the site, then what's the point of looking for the second one, if it should work anyway? The only difference is that the delay was set (benchmark, sleep, etc).
Is there a fundamental difference in the search for the second type from the first?
Thank you.

Answer 1

Is there a fundamental difference in the search for the second type from the first?
There is no fundamental difference in the search, any search for vulnerabilities like SQL Inj comes down to fuzzing.
It is quite possible that some of the vulnerabilities can give you more opportunities than you expected, so, say, some data from some SQL Inj can be executed as executable (interpreted) code, or give some kind of Privilege Escalation. Everything depends on the situation. But there is only one conclusion: it is worth continuing to look.

Answer 2

Blind SQL is such an injection in which the output of data is limited. For example, error messages are disabled.
And such a record will not produce anything:
news.php?id=-1
For this, the following detection methods are used:

news.php?id=-1' OR 1=1
news.php?id=-1' AND 1=1

By compiling such logical queries, we can extract the information of interest to us from the DBMS.
With Double Blind SQL injection, the query logic does not affect the output in any way:
news.php?id=-1' OR 1=1
It will give news and we will definitely not be able to say whether an injection is possible here or not. You can check it this way:
news.php?id=-1' AND benchmark(2000,md5(now()))
The essence of the method is to load the server by performing some lengthy operation (in the benchmark example) and get a response delay.
If we have the ability to implement SQL injection, then the server will issue a response after some time.

If the first one was found when checking the site, then what's the point of looking for the second one, if it should work anyway?

Here, as mentioned above, it all depends on the situation and goals. If the goal is to secure your site, then it is definitely worth checking. To search, it is best to use a scanner, for example METASCAN , there is a special check for response time, or try hackertarget.com.