I know that I can inject time delay but when I type WAITFOR DELAY :0:5, I get a result after about two/three/four/… times later than my value set in the delay. Whats wrong?
It’s a good sign, because now you know that the WAITFOR delay works. However, it means that the injected parameter is used many times in the dynamically built query on the server side. So if the query uses the parameter three times and you used a time delay of 4 seconds, you will get a response approximately after ~13 seconds (~1 second to execute the actual server side code of the web page). Now the good news is that nothing is lost, instead to have your Delay in seconds parameter set to 4 seconds you need to change it for 12 and voila!
