: The attacker sends data payloads and observes the response (e.g., page load time) to learn the database structure. Out-of-band