Boolean Blind SQLi / Targeted Extraction

Many auth flows or search endpoints leak one bit at a time through success/failure, timing, or output shape even when full query results are not reflected.

Why It Works

• A reliable true/false oracle lets you binary-search schema, usernames, and passwords character by character.

Vulnerable Pattern

• Login pages, banking panels, and lookup endpoints where a row match slightly changes the response but errors/dumps are unavailable.

Exploit Flow

1. Build a stable true/false oracle first.
2. Extract schema, usernames, or passwords one character at a time with prefix or character tests.
3. Automate only after manually confirming the oracle is reliable enough for tooling.

Variations

• Substring checks, LIKE, timing via sleep, or sqlmap when the endpoint shape allows it.

Common Blockers

• Noisy responses, rate limits, and logic that authenticates the first true row rather than exposing a direct data oracle.

PoC Sketch

username=admin' AND SUBSTR(password,1,1)='a' -- -
sqlmap -u https://target/login --data='username=*&password=x'

Good Situations To Use It

• A response differs subtly between true and false.
• No error/dump output is available.
• You have a stable, low-noise oracle.

Sources

• midnight_flag2026/web/blackbank
• 0xFUN2026/web/tony_toolkit