sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-07-19 12:42:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

improved detection for INSERT and UPDATE statements

Browse Source
This commit is contained in:
Bernardo Damele 2012-04-03 23:29:06 +00:00
parent 11546cdb6e
commit 049c27c739
1 changed files with 37 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
xml/payloads.xml
View File

@ -451,12 +451,12 @@ Formats:
<!-- Pre-WHERE generic boundaries (e.g. "UPDATE table SET '$_REQUEST["name"]' WHERE id=1" or "INSERT INTO table VALUES('$_REQUEST["value"]') WHERE id=1)"--> <!-- Pre-WHERE generic boundaries (e.g. "UPDATE table SET '$_REQUEST["name"]' WHERE id=1" or "INSERT INTO table VALUES('$_REQUEST["value"]') WHERE id=1)"-->
<boundary> <boundary>
<level>4</level> <level>5</level>
<clause>1</clause> <clause>1</clause>
<where>1,2</where> <where>1,2</where>
<ptype>1</ptype> <ptype>2</ptype>
<prefix>) WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>') WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix></suffix> <suffix>-- AND ('[RANDSTR]'='[RANDSTR]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -464,8 +464,17 @@ Formats:
<clause>1</clause> <clause>1</clause>
<where>1,2</where> <where>1,2</where>
<ptype>2</ptype> <ptype>2</ptype>
<prefix>') WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>") WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix></suffix> <suffix>-- AND ("[RANDSTR]"="[RANDSTR]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>1</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix>) WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- AND ([RANDNUM1]=[RANDNUM1]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -474,7 +483,7 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>2</ptype> <ptype>2</ptype>
<prefix>' WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>' WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix></suffix> <suffix>-- AND '[RANDSTR]'='[RANDSTR]</suffix>
</boundary> </boundary>
<boundary> <boundary>
@ -483,7 +492,16 @@ Formats:
<where>1,2</where> <where>1,2</where>
<ptype>4</ptype> <ptype>4</ptype>
<prefix>" WHERE [RANDNUM]=[RANDNUM]</prefix> <prefix>" WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix></suffix> <suffix>-- AND "[RANDSTR]"="[RANDSTR]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>1</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix> WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>-- AND [RANDNUM1]=[RANDNUM1]</suffix>
</boundary> </boundary>
<!-- End of pre-WHERE generic boundaries --> <!-- End of pre-WHERE generic boundaries -->