---
meta:
  author: "Christian S.J. Peron, Christoph Hansen"
  description: None
  enabled: true
  name: 942190.yaml
tests:
  - test_title: 942190-1
    desc: "MSSQL code execution and information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: GET
            port: 80
            # NB: match with %20 but no bare byte match?
            uri: "/?var=%20exec%20xp_cmdshell"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-2
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%22%21%22%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-3
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%22+union+s%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-4
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "current_user%28%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-5
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "FROM+INFORMATION_SCHEMA.%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-6
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%27%3BSELECT+P%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-7
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "UnIon+seleCt%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-8
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%27union%2F%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-9
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from%2F%2A%2A%2Finformation_schema.%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-10
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "select%5D%3Dpolygon%28%28%2F%2A%2100000select%2A%2F%2A%2F%2A%2100000from%2A%2F%28%2F%2A%2100000select%2A%2F%2A%2F%2A%2100000from%2A%2F%28%2F%2A%2100000select%2A%2Fconcat_ws%280x7e3a%2C0x6d616b6d616e%2Cversion%28%29%2Cuser%28%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-11
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "user%28%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-12
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "database%28%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-13
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "select%28user%28%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-14
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "SeLect%2A%2F+1%2C2%2C3%2Cuser%28%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-15
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "select%5D%3D%28ExtractValue%281%2C%28select%2520concat_ws%280x3a%2Cuser%28%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-16
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from+%60information_schema%60%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-17
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%27select+H%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-18
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%27%3Bselect+p%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-19
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "FROM%2F%2A%2A%2FINFORMATION_SCHEMA.%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-20
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "+EXEC+xp_cmdshell%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-21
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%22%21+Y%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-22
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "exec+master.%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-23
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "into+outfile+%27%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-24
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "Union+sElect%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-25
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "selectect%2520user%28%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-26
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "+exec+master..xp_cmdshell%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-27
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "selectect%252520user%28%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-28
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execution%3De1s1%26OlyH%3D9767+AND+1%3D1+UNION+ALL+SELECT+1%2CNULL%2C%27%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%27%2Ctable_name+FROM+information_schema.tables+WHERE+2%3E1--%2F%2A%2A%2F%3B+EXEC+xp_cmdshell%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-29
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%27%21%60%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-30
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%22+UNION+A%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-31
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "EXec%2F%2A%2A%2Fxp_cmdshell%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-32
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "FrOM%2F%2A%2A%2Finformation_schema.%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-33
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "select+1+FROM%28select+count%28%2A%29%2Cconcat%28%28select+%28select+concat%28user%28%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-34
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%60%211%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-35
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "uNioN++sElecT%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-36
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "%22%3BSELECT+P%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
  - test_title: 942190-37
    desc: "MSSQL Code Execution and Information gathering attempts"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "pay=UnIoN+SeLeCt%0A"
            version: HTTP/1.0
          output:
            log_contains: id "942190"
