Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The response body acts as a one-bit database channel: welcome back! appears for true predicates; length testing finds 20 and substr((select password from users where username=’administrator’),position,1)=candidate reveals each character. That stable marker turns an otherwise blind TrackingId injection into a character-by-character extractor.

Lab objective/setup

Exercise Blind SQL injection with conditional responses through the endpoint and input recorded in the lab note. Welcome back! appears for true predicates; length testing finds 20 and substr((select password from users where username='administrator'),position,1)=candidate reveals each character.

What I observed

Welcome back! appears for true predicates; length testing finds 20 and substr((select password from users where username='administrator'),position,1)=candidate reveals each character.

Paired TrackingId predicates establish that the shop response includes Welcome back only when the injected SQL condition is true.
Paired TrackingId predicates establish that the shop response includes Welcome back only when the injected SQL condition is true.
Intruder tests administrator password lengths through TrackingId and identifies 20 from the sole response containing Welcome back.
Intruder tests administrator password lengths through TrackingId and identifies 20 from the sole response containing Welcome back.
A SUBSTRING predicate in TrackingId tests each administrator password position, using the Welcome back marker as the true branch.
A SUBSTRING predicate in TrackingId tests each administrator password position, using the Welcome back marker as the true branch.

Why it is vulnerable

Welcome back! appears for true predicates; length testing finds 20 and substr((select password from users where username='administrator'),position,1)=candidate reveals each character. The application passes that value into the security-sensitive operation without the context-specific validation or encoding needed to prevent this result.

Walkthrough in the authorized PortSwigger lab

Send paired TrackingId cookies whose predicates differ only in truth value. After confirming that Welcome back! is the oracle, determine the administrator password length and enumerate each position with SUBSTRING, retaining the marker-bearing response as the true branch.

A true Boolean condition in the TrackingId cookie returns the visible Welcome back marker in the shop response.
A true Boolean condition in the TrackingId cookie returns the visible Welcome back marker in the shop response.
Burp Intruder varies the administrator password length and identifies 20 from the marker-bearing response.
Burp Intruder varies the administrator password length and identifies 20 from the marker-bearing response.
SUBSTRING character tests retain Welcome back matches for each position before the recovered credential is accepted at login.
SUBSTRING character tests retain Welcome back matches for each position before the recovered credential is accepted at login.

Verification

The lab is confirmed when Welcome back! appears for true predicates; length testing finds 20 and substr((select password from users where username='administrator'),position,1)=candidate reveals each character. The captured result and the Academy solved state provide the verification; an ordinary status code alone does not.

Impact and defensive lesson

Even without SQL rows or errors in the response, one conditional phrase can disclose an entire credential. Parameterize the TrackingId lookup and make authentication-adjacent UI independent of database predicate outcomes.

References