Boolean-based SQL Injection refers to the response we receive from our injection attempts, which could be a true/false, yes/no, on/off, 1/0 or any response that can only have two outcomes. Even though the response is limited to two outcomes, repeatedly testing different conditions can be used to **enumerate database structure and extract information.

Finding the DB name**

• After determining the number of columns, we can enumerate the database name using database() with the LIKE operator.

• % is a wildcard that matches any characters:

  database() LIKE '%'
  

  → TRUE, because it matches any database name.

• We can test the first character:

  database() LIKE 's%'
  

  → TRUE, meaning the database name starts with s.

• Continue testing characters (sa%, sb%, sc%, etc.) until the complete name is discovered.

• In this lab, the database name is:

  sqli_three

• Once the database name is known, we can use information_schema to enumerate its tables using a similar character-by-character technique; For Tables: random_word' UNION SELECT 1,2,3 FROM information_schema.tables WHERE table_schema = 'DB_name' and table_name like 'a%';— For users (if part of the table): admin123' UNION SELECT 1,2,3 FROM information_schema.tables WHERE table_schema = 'DB_name' and table_name='users';—