# Bug Bounty Collaboration and Manual Exploitation of an Interesting Boolean SQL Injection

Boolean SQL injection in a password-reset username parameter, misidentified as Oracle, exploited via MSSQL DB_NAME() concatenation to enumerate the database name.

- Payout: unconfirmed
- Severity: critical
- Program: -
- Credited: Tavi
- Disclosed: 2022-07-11
- Write-up quality: 7/10
- Original: https://h3k.ro/2022/07/11/bsqli/
- Library page: https://bugbountylibrary.com/r/blog%3Ah3k-ro-2022-07-11-bsqli
- Tags: domain:web impact:data-leak kind:bounty platform:blog sev:critical tech:rest technique:blind technique:recon vuln:sqli

**Target:** Password reset endpoint (passwordResetFunctionality.action) username parameter
**Root cause:** The username parameter is concatenated directly into a SQL query without parameterization, allowing string-concatenation injection that alters query results.
**Steps:**
1. Send `username=test1234567'` -> SYSTEM EXCEPTION with large Content-Length; `test1234567''` -> normal 'No active user found'.
2. Brute-force usernames from SecLists to find a valid inactive user (`superman` -> 'Inactive user', CL 777).
3. Confirm concatenation: `username=superma'||'n` still returns 'Inactive user'.
4. Enumerate columns/tables via `username=superm'||SELECT CASE WHEN (SELECT 1 FROM table)='from' THEN 'a' ELSE 'z' END||n`.
5. Switch from Oracle to MSSQL syntax: `username=superma'||DB_NAME()||'n` works.
6. Extract DB name char-by-char: `username=superm'||SELECT CASE WHEN (SELECT substring(DB_NAME(),§pos§,1))='§char§' THEN 'a' ELSE 'x' END||'n` -> 'superman-database'.
**How found:** Collaborator noticed a single quote broke the query and doubled quotes restored it, indicating string concatenation injection. Initial assumption of Oracle from `'||'` syntax misled payload attempts; after a 3-month break, brute-forcing a valid username gave a controllable boolean oracle, and trying MSSQL `DB_NAME()` despite Oracle indicators revealed the actual DBMS.
**Exploitation:** Blind boolean inference: control the concatenated string so a valid username ('superman') is reconstructed only when the injected condition is true, distinguishing 'Inactive user' (true) from other responses. Used Burp Intruder to brute-force position/character pairs and recover the database name.
**Insight:** `'||'` concatenation is not Oracle-exclusive; when Oracle payloads fail, try MSSQL/other DBMS functions like DB_NAME() before concluding the DBMS. Also, finding any valid username turns a blind error-based injection into a clean boolean oracle by reconstructing the valid string.