---
meta:
  author: "Christoph Hansen"
  description: None
  enabled: true
  name: 942380.yaml
tests:
  - test_title: 942380-1
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from `db_miwf`.`sys_refindex` limit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-2
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from(select count(*),concat((select (select (select concat(0x53,0x65,0x61,0x72,0x63,0x68,0x43,0x6F,0x6C,0x6C,0x65,0x63,0x74,0x6F,0x72) from `information_schema`.tables limit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-3
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from `information_schema`.tables limit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-4
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "ORder by"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-5
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "ordeR by"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-6
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "SELECT (CASE"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-7
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "pay=FROM+termine+GROUP+BY+tag1%26sql_delimit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-8
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "SELECT 6229 FROM(SELECT COUNT(*),CONCAT(0x717a786a71,(SELECT (CASE"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-9
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "SELECT CHAR(113)+CHAR(122)+CHAR(120)+CHAR(106)+CHAR(113)+(SELECT (CASE"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-10
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(122)||CHR(120)||CHR(106)||CHR(113)||(SELECT (CASE"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-11
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "SELECT CONCAT(0x717a786a71,(SELECT (CASE"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-12
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "SELECT (CHR(113)||CHR(122)||CHR(120)||CHR(106)||CHR(113))||(SELECT (CASE"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-13
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "SELECT CHR(113)||CHR(122)||CHR(120)||CHR(106)||CHR(113)||(SELECT (CASE"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-14
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "SELECT 'qzxjq'||(SELECT (CASE"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-15
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execute php"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-16
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from(select count(*),concat((select (select (SELECT concat(user_name,0x7c,password) FROM ecs_admin_user desc limit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-17
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "Execute("
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-18
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from+information_schema.tables+where+BINARY+LEFT%28table_name%2C+1%29+%3D+%27nnn%27+LIMIT"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-19
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from+information_schema.tables+where+table_schema%3Ddatabase%28%29+and+table_name+REGEXP+0x6d656d6265727324+limit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-20
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "fromtype%3DvBForum%3ASocialGroupMessage%26do%3Dprocess%26contenttypeid%3D5%26categoryid%5B%5D%3D-99%29+union+select+salt+from+user+where+userid%3D1+and+row%281%2C1%29%3E%28select+count%28%2A%29%2Cconcat%28+%28select+user.salt%29+%2C0x3a%2Cfloor%28rand%280%29%2A2%29%29+x+from+%28select+1+union+select+2+union+select+3%29a+group+by+x+limit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-21
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from%2F%2A%2A%2F%28select%2F%2A%2A%2Fcount%28%2A%29%2Cconcat%28floor%28rand%280%29%2A2%29%2C0x3a%2C%28select%2F%2A%2A%2Fconcat%28user%2C0x3a%2Cpassword%29%2F%2A%2A%2Ffrom%2F%2A%2A%2Fpwn_base_admin%2F%2A%2A%2Flimit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-22
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "HAVING+1%3D"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-23
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execute+elysi"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-24
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "FROM%28SELECT+COUNT%28%2A%29%2CCONCAT%280x716a766b71%2C%28SELECT+%28ELT%283419%3D3419%2C1%29%29%29%2C0x7171717071%2CFLOOR%28RAND%280%29%2A2%29%29x+FROM+INFORMATION_SCHEMA.PLUGINS+GROUP+BY+x%29a%29%26limit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-25
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "FROM%28SELECT+COUNT%28%2A%29%2CCONCAT%280x716a766b71%2C%28SELECT+%28ELT%289184%3D9184%2C1%29%29%29%2C0x7171717071%2CFLOOR%28RAND%280%29%2A2%29%29x+FROM+INFORMATION_SCHEMA.PLUGINS+GROUP+BY+x%29a%29+AND+%27%25%27%3D%27%26limit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-26
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from%28select%28sleep%2820%29%29%29a%29%27%26data%5BJob%5D%5Blimit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-27
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from%28select%28sleep%2820%29%29%29a%29%2B%27%26data%5BJob%5D%5Blimit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-28
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from%28select%28sleep%2820%29%29%29a%29--+%26data%5BJob%5D%5Blimit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-29
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "from%28select%28sleep%2820%29%29%29a%29%26data%5BJob%5D%5Blimit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-30
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "FROM+ack_variable+WHERE+name%3D%22cron_last%22%3B%26sql_delimit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-31
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execute node_"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-32
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execute scald"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-33
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execute system"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-34
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execute user_"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-35
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execute views"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-36
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execute patha"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-37
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execute workb"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-38
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "execute panel"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-39
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "pay=from+information_schema.tables+where+1%3D2+limit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-40
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "pay=FROM%2B%2560oxattribute%2560%2BWHERE%2BCONVERT%2528%2560oxattribute%2560.%2560OXID%2560%2BUSING%2Butf8%2529%2B%253D%2B%2527n550a1cee455b9ce585343d75d112b77%2527%2BLIMIT"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-41
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "pay=FROM%28select+count%28%2A%29%2Cconcat%28%28select+%28select+concat%28session_id%29%29+FROM+jml_session+LIMIT"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-42
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "pay=SELECT+dDJq+WHERE+9896%3D9896%3BSELECT+%28CASE"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-43
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "pay=FROM+%60we_tblErrorLog%60+WHERE+%60we_tblErrorLog%60.%60ID%60+%3D+25251+LIMIT"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
  - test_title: 942380-44
    desc: "SQL Injection Attack"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "pay=FROM+%60dates%60+order+by+%60uname%60%2C+%60date%60%2C+%60load%60%26dummy%3D%60uname%60%26dummy%3D%60datum%60%26dummy%3D%60laden%60%26sql_delimit"
            version: HTTP/1.0
          output:
            log_contains: id "942380"
