The character oracle reads a value one position at a time. substring(value FROM pos FOR 1) (or substring(value, pos, 1)) returns the character at pos, and ascii(...) gives its code point for a comparison the response reveals as true or false.
Extract a value with a binary search over each position. For the first character of the first role's password hash:
' AND ascii(substring((SELECT passwd FROM pg_shadow LIMIT 1),1,1))>64--
' AND ascii(substring((SELECT passwd FROM pg_shadow LIMIT 1),1,1))>96--
' AND ascii(substring((SELECT passwd FROM pg_shadow LIMIT 1),1,1))=116--
Each > test halves the candidate range, so a printable character resolves in about seven requests. Advance the substring position to walk the string and stop at the length found earlier.
When comparison operators are filtered, substring(...) = 't' tests equality directly, and the SQL-standard substring(value FROM pos FOR 1) form avoids the comma that some filters block. Against an unprivileged role that cannot read pg_shadow, point the subquery at an application table instead. Like all blind extraction, this is heavily automated, but the per-request comparison is the reliable primitive underneath the tooling.
Tools#
- sqlmap: automated boolean-based blind extraction with binary search.
- ghauri: fast alternative with strong WAF evasion.
References#
- PostgreSQL Documentation:
substring,ascii - PortSwigger Web Security Academy: Blind SQL injection