---
meta:
  author: "Christian S.J. Peron, Christoph Hansen"
  description: None
  enabled: true
  name: 942140.yaml
tests:
  - test_title: 942140-1
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: GET
            port: 80
            uri: "/?sql_table=pg_catalog"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-2
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "INFORMATION_SCHEMA"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-3
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "database("
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-4
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "db_name("
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-5
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "DaTaBasE("
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-6
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "InFoRmaTioN_ScHemA"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-7
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "DB_NAME("
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-8
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "tempdb"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-9
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "msdb"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-10
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "mysql.db"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-11
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "MSysAccessObjects"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-12
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "Northwind"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-13
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "northwind"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-14
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "SCHEMA_NAME"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-15
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "DATABASE("
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-16
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "schema_name"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
  - test_title: 942140-17
    desc: "SQL Injection Attack: Common DB Names Detected"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "information_schema"
            version: HTTP/1.0
          output:
            log_contains: id "942140"
