## TL;DR
Time-based blind tests are the slowest technique sqlmap has; an agent should never lead with them. Order the run boolean-based first, then error-based, then time-based only if the faster ones come back negative, and bound the time-based phase with a small `--time-sec` and a hard timeout. Most injections are found before the slow test ever runs.

```text
agent timed out waiting for sqlmap time-based test; the test failed on authorized app
```

## Use this when
- sqlmap hangs in the time-based blind phase against an authorized test app and the agent's step times out.
- The agent runs sqlmap with default technique ordering and no time bounds.
- Faster techniques were never tried, or their results were ignored.

## Not for this skill when
- sqlmap cannot reach the target URL at all. That is a connectivity problem.
- The tester explicitly needs time-based confirmation and allocated the hours. That is a plan, not a breakdown.
- The injection point only responds to time-based payloads and the engagement scoped for it. Then the slowness is inherent.

## Steps
1. Run the fast techniques first: `sqlmap -u TARGET_URL --technique=BE --batch`. Verify: boolean and error-based results return in minutes, not hours.
2. Only escalate to time-based when the fast pass is negative, and bound it: `--technique=T --time-sec=2 --timeout=30`. Verify: each request has a ceiling so one slow response cannot stall the run.
3. Wrap the whole sqlmap invocation in an explicit timeout sized to the phase, for example `timeout 2400` for the time-based phase. Verify: a stuck phase exits with code 124 and the session file survives.
4. Save the sqlmap session (`--session-file`) so a killed run resumes with `--resume` instead of restarting. Verify: the resumed run skips payloads already tested.
5. Record which techniques were tried and their outcome in the run notes before moving on. Verify: the notes say "boolean: negative, error: negative, time: timed out" rather than just "failed".

## Variant phrasings
### sqlmap time-based test too slow for agent run
Same ordering fix.
### agent step timeout during sqlmap blind injection
Step-budget phrasing.
### sqlmap hangs on time-based payloads
Tool-symptom variant.

Compatibility: sqlmap 1.7+. Technique flags and session resume are stable across recent versions.

## Why it happens
Default sqlmap tries every technique in order, and time-based blind inference needs dozens of delayed requests per bit of data. Against a slow authorized app each request can take the full delay window, so the phase stretches past any reasonable agent step limit. The agent sees a hang; really it is a technique that was always going to take hours, started without a budget.

## Edge cases / pitfalls
- A short `--time-sec` on a high-latency app causes false negatives. Calibrate the delay against the app's normal response time first, or a genuinely injectable parameter reads as clean.
- Time-based tests against production-authorized apps generate heavy load. Keep request rates within the engagement's agreed limits.
- A timed-out time-based phase is inconclusive, not negative. Report it as "not completed", never as "not vulnerable".

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_hA_cBcIJsBRaU5kqCh8u6A