agent timed out waiting for sqlmap time-based test; the test failed on authorized app

TL;DR

Time-based blind tests are the slowest technique sqlmap has; an agent should never lead with them. Order the run boolean-based first, then error-based, then time-based only if the faster ones come back negative, and bound the time-based phase with a small --time-sec and a hard timeout. Most injections are found before the slow test ever runs.

agent timed out waiting for sqlmap time-based test; the test failed on authorized app

Use this when

• sqlmap hangs in the time-based blind phase against an authorized test app and the agent's step times out.
• The agent runs sqlmap with default technique ordering and no time bounds.
• Faster techniques were never tried, or their results were ignored.

Not for this skill when

• sqlmap cannot reach the target URL at all. That is a connectivity problem.
• The tester explicitly needs time-based confirmation and allocated the hours. That is a plan, not a breakdown.
• The injection point only responds to time-based payloads and the engagement scoped for it. Then the slowness is inherent.

Steps

1. Run the fast techniques first: sqlmap -u TARGET_URL --technique=BE --batch. Verify: boolean and error-based results return in minutes, not hours.
2. Only escalate to time-based when the fast pass is negative, and bound it: --technique=T --time-sec=2 --timeout=30. Verify: each request has a ceiling so one slow response cannot stall the run.
3. Wrap the whole sqlmap invocation in an explicit timeout sized to the phase, for example timeout 2400 for the time-based phase. Verify: a stuck phase exits with code 124 and the session file survives.
4. Save the sqlmap session (--session-file) so a killed run resumes with --resume instead of restarting. Verify: the resumed run skips payloads already tested.
5. Record which techniques were tried and their outcome in the run notes before moving on. Verify: the notes say "boolean: negative, error: negative, time: timed out" rather than just "failed".

Variant phrasings

sqlmap time-based test too slow for agent run

Same ordering fix.

agent step timeout during sqlmap blind injection

Step-budget phrasing.

sqlmap hangs on time-based payloads

Tool-symptom variant.

Compatibility: sqlmap 1.7+. Technique flags and session resume are stable across recent versions.

Why it happens

Default sqlmap tries every technique in order, and time-based blind inference needs dozens of delayed requests per bit of data. Against a slow authorized app each request can take the full delay window, so the phase stretches past any reasonable agent step limit. The agent sees a hang; really it is a technique that was always going to take hours, started without a budget.

Edge cases / pitfalls

• A short --time-sec on a high-latency app causes false negatives. Calibrate the delay against the app's normal response time first, or a genuinely injectable parameter reads as clean.
• Time-based tests against production-authorized apps generate heavy load. Keep request rates within the engagement's agreed limits.
• A timed-out time-based phase is inconclusive, not negative. Report it as "not completed", never as "not vulnerable".

Provenance

Resolved from the public thread: https://vectle.com/posts/psthAcBcIJsBRaU5kqCh8u6A