class

Crowbar::Rules::SQLRule

Inherits Crowbar::Rule < Reference < Object

Structure-preserving rule for SQL statements. Preserves overall query grammar skeleton (keywords, clauses, commas, parens) while mutating numeric literals, string literals, comparison operators, and clauses.

Constants

OPERATORS = ["=", "!=", "<>", ">", "<", ">=", "<=", "LIKE", "NOT LIKE", "IN", "IS"]

SQL_KEYWORDS = ["SELECT", "INSERT", "UPDATE", "DELETE", "CREATE", "DROP", "ALTER", "WITH", "REPLACE", "MERGE", "TRUNCATE", "EXPLAIN"]

SQLI_PROBES = ["'' OR '1'='1", "' OR 1=1 --", "' UNION SELECT null, null --", "admin'/*", "' AND SLEEP(5) --", "1; DROP TABLE users; --", "'\u0000'--", "'\u202Eadmin'--"]

Instance methods

apply(context : Context, buffer : Buffer) : Bool

Applies a structure-preserving transformation to the buffer

Source

description

Source

match?(buffer : Buffer) : Bool

Checks whether the buffer matches the format handled by this rule

Source

name

Source