Query Me This

A search box backed by an articles table that only shows rows where visibility='public'. The flag is a hidden private row.

The query turns out to be ... WHERE col LIKE '%<q>%', so a leading ' makes LIKE '%' — always true. That's the trap: every ' OR 1=1 floods all rows and looks like a bypass that does nothing. The real lever is AND, not OR.

Backend is SQLite, errors are swallowed (a broken query just says "Nothing matched"), and the only filtering is on comment-to-end tokens (--, #, /*). So instead of commenting out the rest of the query, I balance the trailing %' with a '1' like '1 tail. That gives a clean boolean oracle — rows = TRUE, "Nothing matched" = FALSE:

' and (CONDITION) and '1' like '1

With no data reflected on the page, this is pure boolean-blind extraction. Walk sqlite_master (count → name length → each character via a binary search on unicode(substr(...))), pull the schema out of the CREATE TABLE text, then dump the hidden row:

' and ((select summary from articles where visibility='private')='proof_...') and '1' like '1

The server only ever answers true/false, but asking a few hundred of the right yes/no questions reconstructs the whole string. Flag captured — and the same payload worked unchanged across three instances (/lookup, /explore, /search); only the endpoint path changed.