sqlmap/xml/livetests.xml

<?xml version="1.0" encoding="UTF-8"?>

<root>
    <vars>
        <random value="random"/>
    </vars>
    <global>
        <ignoreProxy value="True"/>
        <batch value="True"/>
        <verbose value="1"/>
    </global>
    <!-- Common enumeration switches across all techniques -->
    <case name="MySQL boolean-based multi-threaded enumeration - all entries">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <extensiveFp value="True"/>
            <getBanner value="True"/>
            <getCurrentUser value="True"/>
            <getCurrentDb value="True"/>
            <getHostname value="True"/>
            <isDba value="True"/>
            <getUsers value="True"/>
            <getPasswordHashes value="True"/>
            <getPrivileges value="True"/>
            <getRoles value="True"/>
            <getDbs value="True"/>
            <getTables value="True"/>
            <getColumns value="True"/>
            <getCount value="True"/>
            <dumpTable value="True"/>
            <db value="testdb"/>
            <tbl value="users"/>
            <excludeSysDbs value="True"/>
        </switches>
        <parse>
            <item value="Title: AND boolean-based blind - WHERE or HAVING clause"/>
            <item value="r'back-end DBMS: active fingerprint: MySQL &gt;= 5.1.12 and &lt; 5.5.0'"/>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="current user:    'root@localhost'"/>
            <item value="current database:    'testdb'"/>
            <item value="hostname:    'debian"/>
            <item value="current user is DBA:    True"/>
            <item value="r'database management system users \[.+'debian-sys-maint'@'localhost'.+'root'@''"/>
            <item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29.+clear-text password: testpass'"/>
            <item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
            <item value="r'database management system users roles:.+debian-sys-maint.+\[.+root.+\[.+role: SUPER'"/>
            <item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
            <item value="r'Database: testdb.+3 tables.+users'"/>
            <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
            <item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
            <item value="r'Database: testdb.+Table: users.+5 entries.+luther.+nameisnull.+'"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded enumeration - all entries">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <extensiveFp value="True"/>
            <getBanner value="True"/>
            <getCurrentUser value="True"/>
            <getCurrentDb value="True"/>
            <getHostname value="True"/>
            <isDba value="True"/>
            <getUsers value="True"/>
            <getPasswordHashes value="True"/>
            <getPrivileges value="True"/>
            <getRoles value="True"/>
            <getDbs value="True"/>
            <getTables value="True"/>
            <getColumns value="True"/>
            <getCount value="True"/>
            <dumpTable value="True"/>
            <db value="testdb"/>
            <tbl value="users"/>
            <excludeSysDbs value="True"/>
            <answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
        </switches>
        <parse>
            <item value="Title: MySQL &gt;= 5.0 AND error-based - WHERE or HAVING clause"/>
            <item value="r'back-end DBMS: active fingerprint: MySQL &gt;= 5.1.12 and &lt; 5.5.0'"/>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="current user:    'root@localhost'"/>
            <item value="current database:    'testdb'"/>
            <item value="hostname:    'debian"/>
            <item value="current user is DBA:    True"/>
            <item value="r'database management system users \[.+'debian-sys-maint'@'localhost'.+'root'@''"/>
            <item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
            <item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
            <item value="r'database management system users roles:.+debian-sys-maint.+\[.+root.+\[.+role: SUPER'"/>
            <item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
            <item value="r'Database: testdb.+3 tables.+users'"/>
            <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
            <item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
            <item value="r'Database: testdb.+Table: users.+5 entries.+luther.+nameisnull.+'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded enumeration - all entries">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <extensiveFp value="True"/>
            <getBanner value="True"/>
            <getCurrentUser value="True"/>
            <getCurrentDb value="True"/>
            <getHostname value="True"/>
            <isDba value="True"/>
            <getUsers value="True"/>
            <getPasswordHashes value="True"/>
            <getPrivileges value="True"/>
            <getRoles value="True"/>
            <getDbs value="True"/>
            <getTables value="True"/>
            <getColumns value="True"/>
            <getCount value="True"/>
            <dumpTable value="True"/>
            <db value="testdb"/>
            <tbl value="users"/>
            <excludeSysDbs value="True"/>
            <answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
        </switches>
        <parse>
            <item value="Title: MySQL UNION query (NULL) - 3 columns"/>
            <item value="r'back-end DBMS: active fingerprint: MySQL &gt;= 5.1.12 and &lt; 5.5.0'"/>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="current user:    'root@localhost'"/>
            <item value="current database:    'testdb'"/>
            <item value="hostname:    'debian"/>
            <item value="current user is DBA:    True"/>
            <item value="r'database management system users \[.+'debian-sys-maint'@'localhost'.+'root'@''"/>
            <item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
            <item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
            <item value="r'database management system users roles:.+debian-sys-maint.+\[.+root.+\[.+role: SUPER'"/>
            <item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
            <item value="r'Database: testdb.+3 tables.+users'"/>
            <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
            <item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
            <item value="r'Database: testdb.+Table: users.+5 entries.+luther.+nameisnull.+'"/>
        </parse>
    </case>
    <case name="MySQL partial UNION query multi-threaded enumeration - all entries">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_partialunion.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <extensiveFp value="True"/>
            <getBanner value="True"/>
            <getCurrentUser value="True"/>
            <getCurrentDb value="True"/>
            <getHostname value="True"/>
            <isDba value="True"/>
            <getUsers value="True"/>
            <getPasswordHashes value="True"/>
            <getPrivileges value="True"/>
            <getRoles value="True"/>
            <getDbs value="True"/>
            <getTables value="True"/>
            <getColumns value="True"/>
            <getCount value="True"/>
            <dumpTable value="True"/>
            <db value="testdb"/>
            <tbl value="users"/>
            <excludeSysDbs value="True"/>
            <answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
        </switches>
        <parse>
            <item value="Title: MySQL UNION query (NULL) - 3 columns"/>
            <item value="r'back-end DBMS: active fingerprint: MySQL &gt;= 5.1.12 and &lt; 5.5.0'"/>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="current user:    'root@localhost'"/>
            <item value="current database:    'testdb'"/>
            <item value="hostname:    'debian"/>
            <item value="current user is DBA:    True"/>
            <item value="r'database management system users \[.+'debian-sys-maint'@'localhost'.+'root'@''"/>
            <item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
            <item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
            <item value="r'database management system users roles:.+debian-sys-maint.+\[.+root.+\[.+role: SUPER'"/>
            <item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
            <item value="r'Database: testdb.+3 tables.+users'"/>
            <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
            <item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
            <item value="r'Database: testdb.+Table: users.+5 entries.+luther.+nameisnull.+'"/>
        </parse>
    </case>
    <case name="MySQL time-based single-threaded enumeration - all entries">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_nooutput.php?id=1"/>
            <tech value="T"/>
            <timeSec value="2"/>
            <getBanner value="True"/>
            <isDba value="True"/>
        </switches>
        <parse>
            <item value="Title: MySQL &gt; 5.0.11 AND time-based blind"/>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="current user is DBA:    True"/>
        </parse>
    </case>
    <case name="MySQL inline queries multi-threaded enumeration - all entries">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_inline.php?id=1"/>
            <threads value="4"/>
            <tech value="Q"/>
            <extensiveFp value="True"/>
            <getBanner value="True"/>
            <getCurrentUser value="True"/>
            <getCurrentDb value="True"/>
            <getHostname value="True"/>
            <isDba value="True"/>
            <getUsers value="True"/>
            <getPasswordHashes value="True"/>
            <getPrivileges value="True"/>
            <getRoles value="True"/>
            <getDbs value="True"/>
            <getTables value="True"/>
            <getColumns value="True"/>
            <getCount value="True"/>
            <dumpTable value="True"/>
            <db value="testdb"/>
            <tbl value="users"/>
            <excludeSysDbs value="True"/>
            <answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
        </switches>
        <parse>
            <item value="Title: MySQL inline queries"/>
            <item value="r'back-end DBMS: active fingerprint: MySQL &gt;= 5.1.12 and &lt; 5.5.0'"/>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="current user:    'root@localhost'"/>
            <item value="current database:    'testdb'"/>
            <item value="hostname:    'debian"/>
            <item value="current user is DBA:    True"/>
            <item value="r'database management system users \[.+'debian-sys-maint'@'localhost'.+'root'@''"/>
            <item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
            <item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
            <item value="r'database management system users roles:.+debian-sys-maint.+\[.+root.+\[.+role: SUPER'"/>
            <item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
            <item value="r'Database: testdb.+3 tables.+users'"/>
            <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
            <item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
            <item value="r'Database: testdb.+Table: users.+5 entries.+luther.+nameisnull.+'"/>
        </parse>
    </case>
    <!-- End of common enumeration switches across all techniques -->

    <!-- Custom enumeration switches -->
    <case name="MySQL error-based multi-threaded custom enumeration">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <getSchema value="True"/>
            <dumpTable value="True"/>
            <db value="testdb"/>
            <tbl value="users"/>
            <limitStart value="2"/>
            <limitStop value="4"/>
            <excludeSysDbs value="True"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
            <item value="r'Database: testdb.+Table: users.+3 entries.+fluffy.+bunny.+wu.+ming'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded custom enumeration">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <getSchema value="True"/>
            <dumpTable value="True"/>
            <db value="testdb"/>
            <tbl value="users"/>
            <limitStart value="2"/>
            <limitStop value="4"/>
            <excludeSysDbs value="True"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
            <item value="r'Database: testdb.+Table: users.+3 entries.+fluffy.+bunny.+wu.+ming'"/>
        </parse>
    </case>
    <case name="MySQL boolean-based multi-threaded custom enumeration - substring">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <dumpTable value="True"/>
            <db value="testdb"/>
            <tbl value="users"/>
            <firstChar value="3"/>
            <lastChar value="5"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+5 entries.+the     | iss.+&lt;blank&gt; | mei'"/>
        </parse>
    </case>
    <!-- End of custom enumeration switches -->

    <!-- Search enumeration switches -->
    <case name="MySQL boolean-based multi-threaded search enumeration - database">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <search value="True"/>
            <db value="e"/>
        </switches>
        <parse>
            <item value="r'found databases.+:.+\[\*\] information_schema.+\[\*\] testdb'"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded search enumeration - database">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <search value="True"/>
            <db value="e"/>
        </switches>
        <parse>
            <item value="r'found databases.+:.+\[\*\] information_schema.+\[\*\] testdb'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded search enumeration - database">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <search value="True"/>
            <db value="e"/>
        </switches>
        <parse>
            <item value="r'found databases.+:.+\[\*\] information_schema.+\[\*\] testdb'"/>
        </parse>
    </case>
    <case name="MySQL boolean-based multi-threaded search enumeration - tables given database">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <search value="True"/>
            <db value="testdb"/>
            <tbl value="foo,se,bar"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+1 table.+users'"/>
            <item value="r'.+5 entries.+wu.+nameisnull'"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded search enumeration - tables given database">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <search value="True"/>
            <db value="testdb"/>
            <tbl value="foo,se,bar"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+1 table.+users'"/>
            <item value="r'.+5 entries.+wu.+nameisnull'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded search enumeration - tables given database">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <search value="True"/>
            <db value="testdb"/>
            <tbl value="foo,se,bar"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+1 table.+users'"/>
            <item value="r'.+5 entries.+wu.+nameisnull'"/>
        </parse>
    </case>
    <case name="MySQL boolean-based multi-threaded search enumeration - tables without given database">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <search value="True"/>
            <tbl value="user"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+1 table.+users.+Database: mysql.+1 table.+user '"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded search enumeration - tables without given database">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <search value="True"/>
            <tbl value="user"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+1 table.+users.+Database: mysql.+1 table.+user '"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded search enumeration - tables without given database">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <search value="True"/>
            <tbl value="user"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+1 table.+users.+Database: mysql.+1 table.+user '"/>
        </parse>
    </case>
    <case name="MySQL boolean-based multi-threaded search enumeration - column without given db or table">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <search value="True"/>
            <col value="name"/>
            <excludeSysDbs value="True"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+surname'"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded search enumeration - column without given db or table">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <search value="True"/>
            <col value="name"/>
            <excludeSysDbs value="True"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+varchar\(500\).+surname.+varchar\(1000\)'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded search enumeration - column without given db or table">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <search value="True"/>
            <col value="name"/>
            <excludeSysDbs value="True"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+varchar\(500\).+surname.+varchar\(1000\)'"/>
        </parse>
    </case>
    <case name="MySQL boolean-based multi-threaded search enumeration - column given databases">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <search value="True"/>
            <db value="mysql,testdb"/>
            <col value="name"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+surname'"/>
            <item value="r'Database: mysql.+Table: plugin.+1 column.+name'"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded search enumeration - column given databases">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <search value="True"/>
            <db value="mysql,testdb"/>
            <col value="name"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+varchar\(500\).+surname.+varchar\(1000\)'"/>
            <item value="r'Database: mysql.+Table: plugin.+1 column.+name.+char\(64\)'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded search enumeration - column given databases">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <search value="True"/>
            <db value="mysql,testdb"/>
            <col value="name"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+varchar\(500\).+surname.+varchar\(1000\)'"/>
            <item value="r'Database: mysql.+Table: plugin.+1 column.+name.+char\(64\)'"/>
        </parse>
    </case>
    <case name="MySQL boolean-based multi-threaded search enumeration - column given tables">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <search value="True"/>
            <tbl value="users,plugin"/>
            <col value="name"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+surname'"/>
            <item value="r'Database: mysql.+Table: plugin.+1 column.+name'"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded search enumeration - column given tables">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <search value="True"/>
            <tbl value="users,plugin"/>
            <col value="name"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+varchar\(500\).+surname.+varchar\(1000\)'"/>
            <item value="r'Database: mysql.+Table: plugin.+1 column.+name.+char\(64\)'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded search enumeration - column given tables">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <search value="True"/>
            <tbl value="users,plugin"/>
            <col value="name"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+varchar\(500\).+surname.+varchar\(1000\)'"/>
            <item value="r'Database: mysql.+Table: plugin.+1 column.+name.+char\(64\)'"/>
        </parse>
    </case>
    <case name="MySQL boolean-based multi-threaded search enumeration - column given databases and table">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <search value="True"/>
            <db value="mysql,testdb"/>
            <tbl value="users"/>
            <col value="name"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+surname'"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded search enumeration - column given databases and table">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <search value="True"/>
            <db value="mysql,testdb"/>
            <tbl value="users"/>
            <col value="name"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+varchar\(500\).+surname.+varchar\(1000\)'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded search enumeration - column given databases and table">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <search value="True"/>
            <db value="mysql,testdb"/>
            <tbl value="users"/>
            <col value="name"/>
            <answers value="do you want to dump=N"/>
        </switches>
        <parse>
            <item value="r'Database: testdb.+Table: users.+2 columns.+name.+varchar\(500\).+surname.+varchar\(1000\)'"/>
        </parse>
    </case>
    <!-- End of search enumeration switches -->

    <!-- User's provided statement enumeration switches -->
    <case name="MySQL boolean-based multi-threaded custom SQL query enumeration">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <query value="SELECT * FROM users LIMIT 0, 2"/>
        </switches>
        <parse>
            <item value="r'SELECT \* FROM users LIMIT 0, 2 \[2\].+1, luther, blissett.+2, fluffy, bunny'"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded custom SQL query enumeration">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <query value="SELECT * FROM users LIMIT 0, 2"/>
        </switches>
        <parse>
            <item value="r'SELECT \* FROM users LIMIT 0, 2 \[2\].+1, luther, blissett.+2, fluffy, bunny'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded custom SQL query enumeration">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <query value="SELECT * FROM users LIMIT 0, 2"/>
        </switches>
        <parse>
            <item value="r'SELECT \* FROM users LIMIT 0, 2 \[2\].+1, luther, blissett.+2, fluffy, bunny'"/>
        </parse>
    </case>
    <case name="MySQL boolean-based multi-threaded custom ordered SQL query enumeration">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <query value="SELECT * FROM users ORDER BY name"/>
        </switches>
        <parse>
            <item value="r'SELECT \* FROM users ORDER BY name \[5\].+2, fluffy, bunny.+1, luther, blissett.+3, wu, ming'"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded custom ordered SQL query enumeration">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <query value="SELECT * FROM users ORDER BY name"/>
        </switches>
        <parse>
            <item value="r'SELECT \* FROM users ORDER BY name \[5\].+2, fluffy, bunny.+1, luther, blissett.+3, wu, ming'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded custom ordered SQL query enumeration">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <query value="SELECT * FROM users ORDER BY name"/>
        </switches>
        <parse>
            <!-- NOTE: it is not sorted on purpose because UNION does not play well with ORDER BY and it is stripped -->
            <item value="r'SELECT \* FROM users ORDER BY name \[5\].+1, luther, blissett.+2, fluffy, bunny.+3, wu, ming'"/>
        </parse>
    </case>
    <!-- End of user's provided statement enumeration switches -->

    <!-- File system access switches -->
    <case name="MySQL boolean-based multi-threaded file read">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <rFile value="/etc/hosts,/tmp/invalidfile"/>
        </switches>
        <parse>
            <item value="r'files saved to.+files/_etc_hosts \(same file\)'"/>
        </parse>
    </case>
    <case name="MySQL error-based multi-threaded file read">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="E"/>
            <rFile value="/etc/hosts,/tmp/invalidfile"/>
        </switches>
        <parse>
            <item value="r'files saved to.+files/_etc_hosts \(same file\)'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded file read">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <rFile value="/etc/hosts,/tmp/invalidfile"/>
        </switches>
        <parse>
            <item value="r'files saved to.+files/_etc_hosts \(same file\)'"/>
        </parse>
    </case>
    <case name="MySQL UNION query multi-threaded file write">
        <switches>
            <verbose value="2"/>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="U"/>
            <wFile value="/etc/passwd"/>
            <dFile value="/tmp/passwd-${random}"/>
        </switches>
        <parse>
            <item value="the remote file /tmp/passwd-${random} is larger than the local file /etc/passwd" console_output="True"/>
        </parse>
    </case>
    <!-- End of file system access switches -->

    <!-- Operating system access switches -->
    <case name="MySQL web shell - command execution">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <tech value="B"/>
            <osCmd value="id"/>
            <answers value="please provide any additional web server=/var/www/test"/>
        </switches>
        <parse>
            <item value="command standard output:    'uid="/>
        </parse>
    </case>
    <!-- TODO: integration with Metasploit cannot be called yet from live testing
    <case name="MySQL shell via Metasploit integration - command execution">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <tech value="B"/>
            <osPwn value="True"/>
            <msfPath value="/usr/local/bin/"/>
            <answers value="please provide any additional web server=/var/www/test"/>
        </switches>
        <parse>
            <item value="r'Sending stage.+Command shell session.+Linux.+uid='"/>
        </parse>
    </case>
    -->
    <!-- End of operating system access switches -->

    <!-- Technique switches and corner cases -->
    <case name="MySQL 4 time-based against unresponsive page">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_benchmark.php?id=1"/>
            <tech value="T"/>
            <level value="2"/>
            <risk value="2"/>
            <timeSec value="2"/>
        </switches>
        <parse>
            <item value="Type: AND/OR time-based blind"/>
            <item value="Title: MySQL &lt; 5.0.12 AND time-based blind (heavy query)"/>
        </parse>
    </case>
    <case name="MySQL OR boolean-base multi-threaded enumeration">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <testFilter value="OR boolean"/>
            <getBanner value="True"/>
            <isDba value="True"/>
        </switches>
        <parse>
            <item value="Title: OR boolean-based blind - WHERE or HAVING clause"/>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="current user is DBA:    True"/>
        </parse>
    </case>
    <case name="MySQL against page protected by custom weak filter">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_filtered.php?id=1"/>
            <tech value="BE"/>
            <level value="3"/>
        </switches>
        <parse>
            <item value="Title: Generic boolean-based blind - Parameter replace (original value)"/>
            <item value="Title: MySQL &gt;= 5.1 error-based - Parameter replace (EXTRACTVALUE)"/>
        </parse>
    </case>
    <case name="MySQL injection in GROUP BY clause">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_groupby.php?id=1"/>
            <tech value="B"/>
            <level value="3"/>
        </switches>
        <parse>
            <item value="MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)"/>
        </parse>
    </case>
    <case name="MySQL boolean-based multi-threaded enumeration - international data">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_international.php?id=1"/>
            <threads value="4"/>
            <tech value="B"/>
            <getBanner value="True"/>
            <dumpTable value="True"/>
            <db value="testdb"/>
            <tbl value="international"/>
        </switches>
        <parse>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="r'Database: testdb.+Table: international.+3 entries.+šućuraj.+река Москва'"/>
        </parse>
    </case>
    <case name="MySQL against highly dynamic page">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_rand.php?id=1"/>
            <timeSec value="2"/>
        </switches>
        <parse>
            <item value="Title: AND boolean-based blind - WHERE or HAVING clause"/>
            <item value="Title: MySQL &gt;= 5.0 AND error-based - WHERE or HAVING clause"/>
            <item value="Title: MySQL UNION query (NULL) - 3 columns"/>
            <item value="Title: MySQL &gt; 5.0.11 AND time-based blind"/>
        </parse>
    </case>
    <case name="MySQL against a page that returns a 302 redirect page when SQL statement return no output">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_redirected.php?id=1"/>
            <timeSec value="2"/>
        </switches>
        <parse>
            <item value="Title: AND boolean-based blind - WHERE or HAVING clause"/>
            <item value="Title: MySQL UNION query (NULL) - 3 columns"/>
            <item value="Title: MySQL &gt; 5.0.11 AND time-based blind"/>
        </parse>
    </case>
    <case name="MySQL against a page that returns an image">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_img.php?id=1"/>
            <tech value="BT"/>
            <timeSec value="2"/>
        </switches>
        <parse>
            <item value="Title: AND boolean-based blind - WHERE or HAVING clause"/>
            <item value="Title: MySQL &gt; 5.0.11 AND time-based blind"/>
        </parse>
    </case>
    <case name="MySQL against a page that returns a 302 redirect page when SQL statement returns output">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_redirected_true.php?id=1"/>
            <tech value="E"/>
        </switches>
        <parse>
            <item value="Title: MySQL &gt;= 5.0 AND error-based - WHERE or HAVING clause"/>
        </parse>
    </case>
    <case name="MySQL partial UNION query multi-threaded enumeration - invalid bignum">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_partialunion.php?id=1"/>
            <tech value="U"/>
            <invalidBignum value="True"/>
            <getBanner value="True"/>
            <isDba value="True"/>
        </switches>
        <parse>
            <item value="Title: MySQL UNION query (NULL) - 3 columns"/>
            <item value="r'Payload: id=[\d]+\.[\d]+ UNION'"/>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="current user is DBA:    True"/>
        </parse>
    </case>
    <case name="MySQL partial UNION query multi-threaded enumeration - invalid logical">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/get_int_partialunion.php?id=1"/>
            <tech value="U"/>
            <invalidLogical value="True"/>
            <getBanner value="True"/>
            <isDba value="True"/>
        </switches>
        <parse>
            <item value="Title: MySQL UNION query (NULL) - 3 columns"/>
            <item value="r'Payload: id=1 AND [\d]+=[\d]+ UNION'"/>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="current user is DBA:    True"/>
        </parse>
    </case>
    <!-- End of technique switches -->

    <!-- Other switches -->
    <case name="MySQL error-based HTTP basic authentication">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/basic/get_int.php?id=1"/>
            <tech value="E"/>
            <aType value="Basic"/>
            <aCred value="testuser:testpass"/>
            <getBanner value="True"/>
        </switches>
        <parse>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
        </parse>
    </case>
    <case name="MySQL error-based HTTP digest authentication">
        <switches>
            <url value="http://debiandev/sqlmap/mysql/digest/get_int.php?id=1"/>
            <tech value="E"/>
            <aType value="Digest"/>
            <aCred value="testuser:testpass"/>
            <getBanner value="True"/>
        </switches>
        <parse>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
        </parse>
    </case>
    <case name="MySQL boolean-based predict output enumeration">
        <switches>
            <verbose value="2"/>
            <url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
            <predictOutput value="True"/>
            <tech value="B"/>
            <getBanner value="True"/>
        </switches>
        <parse>
            <item value="banner:    '5.1.66-0+squeeze1'"/>
            <item value="r'performed 112 queries'" console_output="True"/>
        </parse>
    </case>
    <!-- End of other switches -->
</root>