Commit Graph

7900 Commits

Author SHA1 Message Date
Timo Boettcher
4f84215eda Work around PostgreSQL query optimizer for error
Sadly, the mechanism triggering the error using CAST to integer on a
string did not work for me. This is probably caused by PostgreSQL
optimizing the query as described in
https://www.postgresql.org/docs/9.6/static/functions-conditional.html :

    "Note: As described in Section 4.2.14, there are various situations
    in which subexpressions of an expression are evaluated at different
    times, so that the principle that "CASE evaluates only necessary
    subexpressions" is not ironclad. For example a constant 1/0
    subexpression will usually result in a division-by-zero failure at
    planning time, even if it's within a CASE arm that would never be
    entered at run time."

My trivial test case for causing/not causing an error based on a
condition was:
------------------------------------------------------------------------
mytestdb=> SELECT CASE WHEN (1=1) THEN 1/1 ELSE 1/0 END;
    1

mytestdb=> SELECT CASE WHEN (1=2) THEN 1/1 ELSE 1/0 END;
ERROR:  division by zero
------------------------------------------------------------------------
As expected, the division by zero error is only triggered when the
condition is not met.

Second, dynamic, testcase (the first character of VERSION() has ASCII
code 80, so last condition is expected to return true):
------------------------------------------------------------------------
mytestdb=> SELECT ASCII(SUBSTRING((COALESCE(CAST(VERSION() AS CHARACTER(10000)),(CHR(32))))::text FROM 1 FOR 1));
    80
(1 row)
mytestdb=>  SELECT (CASE WHEN (ASCII(SUBSTRING((COALESCE(CAST(VERSION() AS CHARACTER(10000)),(CHR(32))))::text FROM 1 FOR 1))>126) THEN 1 ELSE 2/0 END) IS NULL;
ERROR:  division by zero
mytestdb=>  SELECT (CASE WHEN (ASCII(SUBSTRING((COALESCE(CAST(VERSION() AS CHARACTER(10000)),(CHR(32))))::text FROM 1 FOR 1))>26) THEN 1 ELSE 2/0 END) IS NULL;
ERROR:  division by zero
------------------------------------------------------------------------
However, the ELSE part is evaluated both when the condition is true and
when it is not true, as described in the documentation cited above.

This can be worked around by using an error that can not be detected by
static analysis (length of version() is about 100, so last condition is
expected to return true):
------------------------------------------------------------------------
mytestdb=> SELECT (CASE WHEN (char_length(version())<80) THEN (1/(char_length(substring(version(),1,1))-1)) ELSE 2 END);
    2

mytestdb=> SELECT (CASE WHEN (char_length(version())>80) THEN (1/(char_length(substring(version(),1,1))-1)) ELSE 2 END);
ERROR:  division by zero
------------------------------------------------------------------------
While we know that substring(X, 1, 1) will return 1 for any non-empty
string, the database engine is probably not able to optimize that away
based on the slight chance that VERSION() may return an empty string.

This has been used successfully on PostgreSQL 9.6.
2017-10-06 00:03:22 +02:00
Timo Boettcher
423a34c9f3 Add boolean-blind for postgreql in stacked-queries
The patch is based on time-based blind exploitation
2017-10-05 23:58:29 +02:00
Miroslav Stampar
09ddb3bd8b Minor update for #2731 (--smoke-test failed) 2017-10-04 14:02:47 +02:00
Miroslav Stampar
d2af0c7a1f Merge pull request #2731 from eur0pa/patch-1
Added Unicode-escape tamper script
2017-10-04 13:57:35 +02:00
europa
3fbe2f645a Added Unicode-escape tamper script 2017-10-04 12:22:31 +02:00
Miroslav Stampar
f1c102a020 Minor touch for internal re-hashing purposes 2017-10-02 16:32:37 +02:00
Miroslav Stampar
834ea2d0d8 Merge pull request #2728 from syedafzal/add_new_waf
Added identification for waf NAXSI
2017-10-02 16:29:47 +02:00
Syed Afzal
ae972de8fc Added identification for waf NAXSI 2017-10-01 22:15:02 +05:30
Miroslav Stampar
62519eed04 Minor patch (breaking lines on longer outputs - 100%) 2017-09-26 13:18:37 +02:00
Miroslav Stampar
222fd856fa Implementation for #2709 2017-09-25 11:32:40 +02:00
Miroslav Stampar
db94d24db1 Initial support for #2709 (more work to be done) 2017-09-21 14:35:24 +02:00
Miroslav Stampar
116c1c8b5c Minor refactoring 2017-09-20 15:49:18 +02:00
Miroslav Stampar
afc2a42383 Revisiting regexes for DBMS errors 2017-09-20 15:28:33 +02:00
Miroslav Stampar
44664dd7d6 Minor update (based on user request) 2017-09-19 14:36:34 +02:00
Miroslav Stampar
35ba94b3a9 Fixes #2696 2017-09-17 23:56:48 +02:00
Miroslav Stampar
24c261d630 Minor patch 2017-09-17 23:12:57 +02:00
Miroslav Stampar
6a8ea0557c Minor update 2017-09-15 14:23:55 +02:00
Miroslav Stampar
721bf4d243 Minor update related to the #2695 2017-09-14 13:28:24 +02:00
Miroslav Stampar
e02ce4eb1f Merge pull request #2695 from Zwirzu/master
Created polish translaton
2017-09-14 13:24:35 +02:00
Zwirzu
2f8e8a5f62 Created polish translaton
I just translated Readme.md to polish.
2017-09-14 00:03:24 +02:00
Miroslav Stampar
7de63a7efb Fixes #2694 2017-09-12 10:32:22 +02:00
Miroslav Stampar
12f802c70f Minor text update 2017-09-11 10:41:50 +02:00
Miroslav Stampar
96ffb4b911 Fixes #2693 2017-09-11 10:38:19 +02:00
Miroslav Stampar
93cb879e5d Fixes #2692 2017-09-11 10:17:02 +02:00
Miroslav Stampar
f67f26cebd Minor update 2017-09-11 10:00:35 +02:00
Miroslav Stampar
942ac7733a Fixes #2691 2017-09-09 22:27:40 +02:00
Miroslav Stampar
2496db9d96 Update for #2690 2017-09-08 11:59:26 +02:00
Miroslav Stampar
a3249019d9 Patch for an Issue #2690 2017-09-08 11:43:10 +02:00
Miroslav Stampar
96f80879ff Fixes #2688 2017-09-06 23:41:56 +02:00
Miroslav Stampar
96b9950f96 Fixes #2684 2017-09-05 13:13:08 +02:00
Miroslav Stampar
30ea219228 Fixes #2604 2017-09-05 12:48:51 +02:00
Miroslav Stampar
7c41bc57e7 Fixes #2683 2017-09-05 10:51:58 +02:00
Miroslav Stampar
e609bd04ad Fixes #2678 2017-09-04 23:00:16 +02:00
Miroslav Stampar
511f2a6d12 Update for #2680 2017-09-04 17:16:00 +02:00
Miroslav Stampar
415ce05a2f Fixes #2677 2017-09-04 17:05:48 +02:00
Miroslav Stampar
06deda3223 Fixes #2672 2017-09-01 14:29:52 +02:00
Miroslav Stampar
d4170f11f0 Patch for #2654 2017-08-28 17:29:46 +02:00
Miroslav Stampar
cb2258fea4 Fixes #2603 2017-08-28 13:02:08 +02:00
Miroslav Stampar
c871cedae4 Adding hidden option '--force-dbms' to skip fingerprinting 2017-08-28 12:30:42 +02:00
Miroslav Stampar
3e4130c5e6 Update for #2665 2017-08-28 11:08:36 +02:00
Miroslav Stampar
a6c04a59cb Minor update 2017-08-23 14:10:11 +02:00
Miroslav Stampar
53eb44304f Proper patch for #2666 2017-08-23 14:08:40 +02:00
Miroslav Stampar
400339a884 Fixes #2665 2017-08-23 13:52:51 +02:00
Miroslav Stampar
8b0c50f25d Update related to the #2663 2017-08-23 13:17:37 +02:00
Miroslav Stampar
e42b63f51c Typo fix 2017-08-20 10:02:26 +02:00
Miroslav Stampar
b8f88a079a Fixes #2659 2017-08-20 10:00:04 +02:00
Miroslav Stampar
a761e1d165 Fixes #2656 2017-08-16 03:08:58 +02:00
Miroslav Stampar
5b6926ae05 Fixes #2654 2017-08-11 11:48:05 +02:00
Miroslav Stampar
e862da6d4e Update for an Issue #2653 2017-08-11 10:47:32 +02:00
Miroslav Stampar
1ac0704c09 Fixes #2651 2017-08-09 16:52:36 +02:00