# Boolean SQL injection

Boolean-based SQL injection is a type of SQL injection attack that exploits the boolean logic in SQL queries. In this comprehensive guide, we will delve into the intricacies of this vulnerability, exploring various payloads and techniques used to exploit it effectively.

Firstly, let's clarify the concept of boolean. In computing, boolean refers to a system of algebraic notation that represents logical propositions using binary digits, where 0 signifies false and 1 signifies true. For our purposes, we'll focus on the binary nature of boolean variables, which can only have two possible values: 0 (false) or 1 (true).

To qualify as a boolean-based SQL injection, the injection must be blind, meaning it does not directly output data but rather forces the application to return a true or false response. This characteristic distinguishes boolean-based SQL injection from other types of injection attacks.

The most common payload used in boolean-based SQL injection is the ' OR 1=1 statement. This payload leverages the boolean logic in SQL to always evaluate to true, effectively bypassing authentication mechanisms or filtering conditions set by the application.

However, it's essential to note that boolean-based SQL injection attacks can be slow due to the need to enumerate all possibilities by iterating through true and false conditions. This iterative process increases the time required for the attack to yield results but can ultimately lead to successful exploitation if executed patiently and meticulously.

Suppose we have a vulnerable login form that uses SQL queries to authenticate users:

```sql
SELECT * FROM users WHERE username = 'input_username' AND password = 'input_password';
```

Now, let's say the attacker wants to bypass the authentication and gain unauthorized access. They can input the following username and password:

Username: `admin' OR 1=1 --` Password: `anything you want`

After injection, the SQL query becomes:

```sql
SELECT * FROM users WHERE username = 'admin' OR 1=1 --' AND password = 'anything';
```

In this modified query:

* The `OR 1=1` part always evaluates to true, effectively bypassing the password check.
* The `--` at the end is used to comment out the rest of the original query, ensuring that any subsequent code is ignored by the database.

As a result, the query will return the data of the first user it finds in the database, likely the admin user, granting unauthorized access to the attacker.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://hackingdoc.gitbook.io/web-hacking/sql-injection/boolean-sql-injection.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.