Skip to content

feature: Add SAP HANA Support#6074

Open
zakaria-zoulati wants to merge 3 commits into
sqlmapproject:masterfrom
zakaria-zoulati:feature/add-SAP-HANA-support
Open

feature: Add SAP HANA Support#6074
zakaria-zoulati wants to merge 3 commits into
sqlmapproject:masterfrom
zakaria-zoulati:feature/add-SAP-HANA-support

Conversation

@zakaria-zoulati

Copy link
Copy Markdown
Contributor

Add SAP HANA database support

Adds SAP HANA as a supported target DBMS, including detection, fingerprinting, and full data enumeration.

Changes

  • Register SAP HANA across core DBMS registries (enums, settings, dicts, handler, agent, common, dump)
  • Add HANA SQL dialect to queries.xml: || concatenation, LIMIT/OFFSET, DUMMY table, SYS.* system views for enumeration (tables, columns, schemas, users, privileges, roles)
  • New plugins/dbms/hana/ package: fingerprinting (via MAP() and CURRENT_SCHEMA), enumeration, connector (hdbcli), syntax handling (Oracle-style uppercase identifiers)
  • Fix getColumns() UnboundLocalError for uppercase-identifier DBMSes (Oracle-style branch was missing HANA)

Testing

Validated end-to-end against a real SAP HANA Express 2.00.088 instance (Docker) using a small vulnerable Flask test app:

  • DBMS fingerprint/confirmation
  • Boolean-based blind injection (detection, enumeration, dump)
  • UNION-based injection (detection, enumeration, dump)
  • --banner, --current-user, --current-db, --is-dba, --dbs, --tables, --columns, --dump

Known limitations

  • No time-based blind payload (HANA has no SLEEP())
  • --is-dba may under-report for users granted admin via roles rather than direct privileges

Proof of concept

Capture d'écran 2026-06-13 111026 Capture d'écran 2026-06-13 111109 Capture d'écran 2026-06-13 111154 Capture d'écran 2026-06-13 111236 Capture d'écran 2026-06-13 111323 Capture d'écran 2026-06-13 111416 Capture d'écran 2026-06-13 111509 Capture d'écran 2026-06-13 110920

@zakaria-zoulati zakaria-zoulati force-pushed the feature/add-SAP-HANA-support branch from 7e917ee to 9e92d3c Compare June 13, 2026 10:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant