mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2025-12-03 16:24:15 +03:00
Merge 05b393436f into f22abb36a3
This commit is contained in:
commit
34000188c7
|
|
@ -1785,4 +1785,66 @@
|
||||||
<search_table/>
|
<search_table/>
|
||||||
<search_column/>
|
<search_column/>
|
||||||
</dbms>
|
</dbms>
|
||||||
|
<dbms value="Snowflake">
|
||||||
|
<cast query="CAST(%s AS VARCHAR)"/>
|
||||||
|
<length query="LENGTH(%s)"/>
|
||||||
|
<isnull query="NVL(%s, ' ')"/>
|
||||||
|
<delimiter query="||"/>
|
||||||
|
<limit query="LIMIT %d OFFSET %d"/>
|
||||||
|
<limitregexp query="\s+LIMIT\s+([\d]+)\s+OFFSET\s+([\d]+)"/>
|
||||||
|
<limitgroupstart query="1"/>
|
||||||
|
<limitgroupstop query="2"/>
|
||||||
|
<limitstring query=" LIMIT "/>
|
||||||
|
<order query="ORDER BY %s ASC"/>
|
||||||
|
<count query="COUNT(%s)"/>
|
||||||
|
<comment query="--"/>
|
||||||
|
<concatenate query="%s||%s"/>
|
||||||
|
<case query="SELECT CASE WHEN (%s) THEN 1 ELSE 0 END"/>
|
||||||
|
<inference query="ASCII(SUBSTR((%s),%d,1))>%d"/>
|
||||||
|
<banner query="SELECT CURRENT_VERSION()"/>
|
||||||
|
<current_user query="SELECT CURRENT_USER()"/>
|
||||||
|
<current_db query="SELECT CURRENT_DATABASE()"/>
|
||||||
|
<hostname/>
|
||||||
|
<table_comment/>
|
||||||
|
<column_comment/>
|
||||||
|
<is_dba query="CURRENT_ROLE()='ACCOUNTADMIN'"/>
|
||||||
|
|
||||||
|
<dbs>
|
||||||
|
<inband query="SELECT DATABASE_NAME FROM SNOWFLAKE.INFORMATION_SCHEMA.DATABASES"/>
|
||||||
|
<blind query="SELECT DATABASE_NAME FROM SNOWFLAKE.INFORMATION_SCHEMA.DATABASES ORDER BY DATABASE_NAME LIMIT 1 OFFSET %d" count="SELECT COUNT(*) FROM SNOWFLAKE.INFORMATION_SCHEMA.DATABASES"/>
|
||||||
|
</dbs>
|
||||||
|
|
||||||
|
<tables>
|
||||||
|
<inband query="SELECT TABLE_CATALOG, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES" condition="TABLE_TYPE='BASE TABLE' AND TABLE_CATALOG"/>
|
||||||
|
|
||||||
|
<blind query="SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_CATALOG='%s' ORDER BY TABLE_NAME LIMIT 1 OFFSET %d" count="SELECT COUNT(TABLE_NAME) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_CATALOG='%s'"
|
||||||
|
/>
|
||||||
|
</tables>
|
||||||
|
|
||||||
|
<columns>
|
||||||
|
<inband query="SELECT COLUMN_NAME, DATA_TYPE FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='%s' AND TABLE_CATALOG='%s'"/>
|
||||||
|
<blind query="SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='%s' AND TABLE_CATALOG='%s' LIMIT 1 OFFSET %d" query2="SELECT DATA_TYPE FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='%s' AND COLUMN_NAME='%s' AND TABLE_CATALOG='%s'" count="SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='%s' AND TABLE_CATALOG='%s'"/>
|
||||||
|
</columns>
|
||||||
|
|
||||||
|
<dump_table>
|
||||||
|
<inband query="SELECT %s FROM TABLE('%s')"/>
|
||||||
|
<blind query="SELECT %s FROM %s.%s LIMIT 1 OFFSET %d" count="SELECT COUNT(*) FROM %s.%s"/>
|
||||||
|
</dump_table>
|
||||||
|
|
||||||
|
<users>
|
||||||
|
<inband query="SELECT NAME FROM SNOWFLAKE.ACCOUNT_USAGE.USERS"/>
|
||||||
|
<blind query="SELECT NAME FROM SNOWFLAKE.ACCOUNT_USAGE.USERS LIMIT 1 OFFSET %d" count="SELECT COUNT(*) FROM SNOWFLAKE.ACCOUNT_USAGE.USERS"/>
|
||||||
|
</users>
|
||||||
|
|
||||||
|
<roles>
|
||||||
|
<inband query="SELECT NAME FROM SNOWFLAKE.ACCOUNT_USAGE.ROLES"/>
|
||||||
|
<blind query="SELECT NAME FROM SNOWFLAKE.ACCOUNT_USAGE.ROLES LIMIT 1 OFFSET %d" count="SELECT COUNT(*) FROM SNOWFLAKE.ACCOUNT_USAGE.ROLES"/>
|
||||||
|
</roles>
|
||||||
|
|
||||||
|
<privileges/>
|
||||||
|
<statements/>
|
||||||
|
<search_db/>
|
||||||
|
<search_table/>
|
||||||
|
<search_column/>
|
||||||
|
</dbms>
|
||||||
</root>
|
</root>
|
||||||
|
|
|
||||||
|
|
@ -41,6 +41,7 @@ from lib.core.settings import SQLITE_ALIASES
|
||||||
from lib.core.settings import SYBASE_ALIASES
|
from lib.core.settings import SYBASE_ALIASES
|
||||||
from lib.core.settings import VERTICA_ALIASES
|
from lib.core.settings import VERTICA_ALIASES
|
||||||
from lib.core.settings import VIRTUOSO_ALIASES
|
from lib.core.settings import VIRTUOSO_ALIASES
|
||||||
|
from lib.core.settings import SNOWFLAKE_ALIASES
|
||||||
from lib.utils.sqlalchemy import SQLAlchemy
|
from lib.utils.sqlalchemy import SQLAlchemy
|
||||||
|
|
||||||
from plugins.dbms.access.connector import Connector as AccessConn
|
from plugins.dbms.access.connector import Connector as AccessConn
|
||||||
|
|
@ -99,6 +100,8 @@ from plugins.dbms.vertica.connector import Connector as VerticaConn
|
||||||
from plugins.dbms.vertica import VerticaMap
|
from plugins.dbms.vertica import VerticaMap
|
||||||
from plugins.dbms.virtuoso.connector import Connector as VirtuosoConn
|
from plugins.dbms.virtuoso.connector import Connector as VirtuosoConn
|
||||||
from plugins.dbms.virtuoso import VirtuosoMap
|
from plugins.dbms.virtuoso import VirtuosoMap
|
||||||
|
from plugins.dbms.snowflake.connector import Connector as SnowflakeConn
|
||||||
|
from plugins.dbms.snowflake import SnowflakeMap
|
||||||
|
|
||||||
def setHandler():
|
def setHandler():
|
||||||
"""
|
"""
|
||||||
|
|
@ -107,6 +110,7 @@ def setHandler():
|
||||||
"""
|
"""
|
||||||
|
|
||||||
items = [
|
items = [
|
||||||
|
(DBMS.SNOWFLAKE, SNOWFLAKE_ALIASES, SnowflakeMap, SnowflakeConn),
|
||||||
(DBMS.MYSQL, MYSQL_ALIASES, MySQLMap, MySQLConn),
|
(DBMS.MYSQL, MYSQL_ALIASES, MySQLMap, MySQLConn),
|
||||||
(DBMS.ORACLE, ORACLE_ALIASES, OracleMap, OracleConn),
|
(DBMS.ORACLE, ORACLE_ALIASES, OracleMap, OracleConn),
|
||||||
(DBMS.PGSQL, PGSQL_ALIASES, PostgreSQLMap, PostgreSQLConn),
|
(DBMS.PGSQL, PGSQL_ALIASES, PostgreSQLMap, PostgreSQLConn),
|
||||||
|
|
@ -135,6 +139,7 @@ def setHandler():
|
||||||
(DBMS.FRONTBASE, FRONTBASE_ALIASES, FrontBaseMap, FrontBaseConn),
|
(DBMS.FRONTBASE, FRONTBASE_ALIASES, FrontBaseMap, FrontBaseConn),
|
||||||
(DBMS.RAIMA, RAIMA_ALIASES, RaimaMap, RaimaConn),
|
(DBMS.RAIMA, RAIMA_ALIASES, RaimaMap, RaimaConn),
|
||||||
(DBMS.VIRTUOSO, VIRTUOSO_ALIASES, VirtuosoMap, VirtuosoConn),
|
(DBMS.VIRTUOSO, VIRTUOSO_ALIASES, VirtuosoMap, VirtuosoConn),
|
||||||
|
# TODO: put snowflake stuff on this line
|
||||||
]
|
]
|
||||||
|
|
||||||
_ = max(_ if (conf.get("dbms") or Backend.getIdentifiedDbms() or kb.heuristicExtendedDbms or "").lower() in _[1] else () for _ in items)
|
_ = max(_ if (conf.get("dbms") or Backend.getIdentifiedDbms() or kb.heuristicExtendedDbms or "").lower() in _[1] else () for _ in items)
|
||||||
|
|
|
||||||
|
|
@ -39,6 +39,7 @@ from lib.core.settings import SYBASE_ALIASES
|
||||||
from lib.core.settings import VERTICA_ALIASES
|
from lib.core.settings import VERTICA_ALIASES
|
||||||
from lib.core.settings import VIRTUOSO_ALIASES
|
from lib.core.settings import VIRTUOSO_ALIASES
|
||||||
from lib.core.settings import CLICKHOUSE_ALIASES
|
from lib.core.settings import CLICKHOUSE_ALIASES
|
||||||
|
from lib.core.settings import SNOWFLAKE_ALIASES
|
||||||
|
|
||||||
FIREBIRD_TYPES = {
|
FIREBIRD_TYPES = {
|
||||||
261: "BLOB",
|
261: "BLOB",
|
||||||
|
|
@ -250,6 +251,7 @@ DBMS_DICT = {
|
||||||
DBMS.FRONTBASE: (FRONTBASE_ALIASES, None, None, None),
|
DBMS.FRONTBASE: (FRONTBASE_ALIASES, None, None, None),
|
||||||
DBMS.RAIMA: (RAIMA_ALIASES, None, None, None),
|
DBMS.RAIMA: (RAIMA_ALIASES, None, None, None),
|
||||||
DBMS.VIRTUOSO: (VIRTUOSO_ALIASES, None, None, None),
|
DBMS.VIRTUOSO: (VIRTUOSO_ALIASES, None, None, None),
|
||||||
|
DBMS.SNOWFLAKE: (SNOWFLAKE_ALIASES, None, None, "snowflake"),
|
||||||
}
|
}
|
||||||
|
|
||||||
# Reference: https://blog.jooq.org/tag/sysibm-sysdummy1/
|
# Reference: https://blog.jooq.org/tag/sysibm-sysdummy1/
|
||||||
|
|
|
||||||
|
|
@ -60,6 +60,7 @@ class DBMS(object):
|
||||||
FRONTBASE = "FrontBase"
|
FRONTBASE = "FrontBase"
|
||||||
RAIMA = "Raima Database Manager"
|
RAIMA = "Raima Database Manager"
|
||||||
VIRTUOSO = "Virtuoso"
|
VIRTUOSO = "Virtuoso"
|
||||||
|
SNOWFLAKE = "Snowflake"
|
||||||
|
|
||||||
class DBMS_DIRECTORY_NAME(object):
|
class DBMS_DIRECTORY_NAME(object):
|
||||||
ACCESS = "access"
|
ACCESS = "access"
|
||||||
|
|
@ -90,6 +91,7 @@ class DBMS_DIRECTORY_NAME(object):
|
||||||
FRONTBASE = "frontbase"
|
FRONTBASE = "frontbase"
|
||||||
RAIMA = "raima"
|
RAIMA = "raima"
|
||||||
VIRTUOSO = "virtuoso"
|
VIRTUOSO = "virtuoso"
|
||||||
|
SNOWFLAKE = "snowflake"
|
||||||
|
|
||||||
class FORK(object):
|
class FORK(object):
|
||||||
MARIADB = "MariaDB"
|
MARIADB = "MariaDB"
|
||||||
|
|
|
||||||
|
|
@ -292,6 +292,7 @@ EXTREMEDB_SYSTEM_DBS = ("",)
|
||||||
FRONTBASE_SYSTEM_DBS = ("DEFINITION_SCHEMA", "INFORMATION_SCHEMA")
|
FRONTBASE_SYSTEM_DBS = ("DEFINITION_SCHEMA", "INFORMATION_SCHEMA")
|
||||||
RAIMA_SYSTEM_DBS = ("",)
|
RAIMA_SYSTEM_DBS = ("",)
|
||||||
VIRTUOSO_SYSTEM_DBS = ("",)
|
VIRTUOSO_SYSTEM_DBS = ("",)
|
||||||
|
SNOWFLAKE_SYSTEM_DBS = ("INFORMATION_SCHEMA",)
|
||||||
|
|
||||||
# Note: (<regular>) + (<forks>)
|
# Note: (<regular>) + (<forks>)
|
||||||
MSSQL_ALIASES = ("microsoft sql server", "mssqlserver", "mssql", "ms")
|
MSSQL_ALIASES = ("microsoft sql server", "mssqlserver", "mssql", "ms")
|
||||||
|
|
@ -322,10 +323,11 @@ EXTREMEDB_ALIASES = ("extremedb", "extreme")
|
||||||
FRONTBASE_ALIASES = ("frontbase",)
|
FRONTBASE_ALIASES = ("frontbase",)
|
||||||
RAIMA_ALIASES = ("raima database manager", "raima", "raimadb", "raimadm", "rdm", "rds", "velocis")
|
RAIMA_ALIASES = ("raima database manager", "raima", "raimadb", "raimadm", "rdm", "rds", "velocis")
|
||||||
VIRTUOSO_ALIASES = ("virtuoso", "openlink virtuoso")
|
VIRTUOSO_ALIASES = ("virtuoso", "openlink virtuoso")
|
||||||
|
SNOWFLAKE_ALIASES = ("snowflake",)
|
||||||
|
|
||||||
DBMS_DIRECTORY_DICT = dict((getattr(DBMS, _), getattr(DBMS_DIRECTORY_NAME, _)) for _ in dir(DBMS) if not _.startswith("_"))
|
DBMS_DIRECTORY_DICT = dict((getattr(DBMS, _), getattr(DBMS_DIRECTORY_NAME, _)) for _ in dir(DBMS) if not _.startswith("_"))
|
||||||
|
|
||||||
SUPPORTED_DBMS = set(MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES + H2_ALIASES + INFORMIX_ALIASES + MONETDB_ALIASES + DERBY_ALIASES + VERTICA_ALIASES + MCKOI_ALIASES + PRESTO_ALIASES + ALTIBASE_ALIASES + MIMERSQL_ALIASES + CLICKHOUSE_ALIASES + CRATEDB_ALIASES + CUBRID_ALIASES + CACHE_ALIASES + EXTREMEDB_ALIASES + RAIMA_ALIASES + VIRTUOSO_ALIASES)
|
SUPPORTED_DBMS = set(MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES + H2_ALIASES + INFORMIX_ALIASES + MONETDB_ALIASES + DERBY_ALIASES + VERTICA_ALIASES + MCKOI_ALIASES + PRESTO_ALIASES + ALTIBASE_ALIASES + MIMERSQL_ALIASES + CLICKHOUSE_ALIASES + CRATEDB_ALIASES + CUBRID_ALIASES + CACHE_ALIASES + EXTREMEDB_ALIASES + RAIMA_ALIASES + VIRTUOSO_ALIASES + SNOWFLAKE_ALIASES)
|
||||||
SUPPORTED_OS = ("linux", "windows")
|
SUPPORTED_OS = ("linux", "windows")
|
||||||
|
|
||||||
DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES), (DBMS.H2, H2_ALIASES), (DBMS.INFORMIX, INFORMIX_ALIASES), (DBMS.MONETDB, MONETDB_ALIASES), (DBMS.DERBY, DERBY_ALIASES), (DBMS.VERTICA, VERTICA_ALIASES), (DBMS.MCKOI, MCKOI_ALIASES), (DBMS.PRESTO, PRESTO_ALIASES), (DBMS.ALTIBASE, ALTIBASE_ALIASES), (DBMS.MIMERSQL, MIMERSQL_ALIASES), (DBMS.CLICKHOUSE, CLICKHOUSE_ALIASES), (DBMS.CRATEDB, CRATEDB_ALIASES), (DBMS.CUBRID, CUBRID_ALIASES), (DBMS.CACHE, CACHE_ALIASES), (DBMS.EXTREMEDB, EXTREMEDB_ALIASES), (DBMS.FRONTBASE, FRONTBASE_ALIASES), (DBMS.RAIMA, RAIMA_ALIASES), (DBMS.VIRTUOSO, VIRTUOSO_ALIASES))
|
DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES), (DBMS.H2, H2_ALIASES), (DBMS.INFORMIX, INFORMIX_ALIASES), (DBMS.MONETDB, MONETDB_ALIASES), (DBMS.DERBY, DERBY_ALIASES), (DBMS.VERTICA, VERTICA_ALIASES), (DBMS.MCKOI, MCKOI_ALIASES), (DBMS.PRESTO, PRESTO_ALIASES), (DBMS.ALTIBASE, ALTIBASE_ALIASES), (DBMS.MIMERSQL, MIMERSQL_ALIASES), (DBMS.CLICKHOUSE, CLICKHOUSE_ALIASES), (DBMS.CRATEDB, CRATEDB_ALIASES), (DBMS.CUBRID, CUBRID_ALIASES), (DBMS.CACHE, CACHE_ALIASES), (DBMS.EXTREMEDB, EXTREMEDB_ALIASES), (DBMS.FRONTBASE, FRONTBASE_ALIASES), (DBMS.RAIMA, RAIMA_ALIASES), (DBMS.VIRTUOSO, VIRTUOSO_ALIASES))
|
||||||
|
|
|
||||||
29
plugins/dbms/snowflake/__init__.py
Normal file
29
plugins/dbms/snowflake/__init__.py
Normal file
|
|
@ -0,0 +1,29 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2025 sqlmap developers (https://sqlmap.org)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
from lib.core.enums import DBMS
|
||||||
|
from lib.core.settings import SNOWFLAKE_SYSTEM_DBS
|
||||||
|
from lib.core.unescaper import unescaper
|
||||||
|
from plugins.dbms.snowflake.enumeration import Enumeration
|
||||||
|
from plugins.dbms.snowflake.filesystem import Filesystem
|
||||||
|
from plugins.dbms.snowflake.fingerprint import Fingerprint
|
||||||
|
from plugins.dbms.snowflake.syntax import Syntax
|
||||||
|
from plugins.dbms.snowflake.takeover import Takeover
|
||||||
|
from plugins.generic.misc import Miscellaneous
|
||||||
|
|
||||||
|
class SnowflakeMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover):
|
||||||
|
"""
|
||||||
|
This class defines Snowflake methods
|
||||||
|
"""
|
||||||
|
|
||||||
|
def __init__(self):
|
||||||
|
self.excludeDbsList = SNOWFLAKE_SYSTEM_DBS
|
||||||
|
|
||||||
|
for cls in self.__class__.__bases__:
|
||||||
|
cls.__init__(self)
|
||||||
|
|
||||||
|
unescaper[DBMS.SNOWFLAKE] = Syntax.escape
|
||||||
70
plugins/dbms/snowflake/connector.py
Normal file
70
plugins/dbms/snowflake/connector.py
Normal file
|
|
@ -0,0 +1,70 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2025 sqlmap developers (https://sqlmap.org)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
try:
|
||||||
|
import snowflake.connector
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
|
import logging
|
||||||
|
|
||||||
|
from lib.core.common import getSafeExString
|
||||||
|
from lib.core.convert import getText
|
||||||
|
from lib.core.data import conf
|
||||||
|
from lib.core.data import logger
|
||||||
|
from lib.core.exception import SqlmapConnectionException
|
||||||
|
from plugins.generic.connector import Connector as GenericConnector
|
||||||
|
|
||||||
|
class Connector(GenericConnector):
|
||||||
|
"""
|
||||||
|
Homepage: https://www.snowflake.com/
|
||||||
|
User guide: https://docs.snowflake.com/en/developer-guide/python-connector/python-connector
|
||||||
|
API: https://docs.snowflake.com/en/developer-guide/python-connector/python-connector-api
|
||||||
|
"""
|
||||||
|
|
||||||
|
def __init__(self):
|
||||||
|
GenericConnector.__init__(self)
|
||||||
|
|
||||||
|
def connect(self):
|
||||||
|
self.initConnection()
|
||||||
|
|
||||||
|
try:
|
||||||
|
self.connector = snowflake.connector.connect(
|
||||||
|
user=self.user,
|
||||||
|
password=self.password,
|
||||||
|
account=self.account,
|
||||||
|
warehouse=self.warehouse,
|
||||||
|
database=self.db,
|
||||||
|
schema=self.schema
|
||||||
|
)
|
||||||
|
cursor = self.connector.cursor()
|
||||||
|
cursor.execute("SELECT CURRENT_VERSION()")
|
||||||
|
cursor.close()
|
||||||
|
|
||||||
|
except Exception as ex:
|
||||||
|
raise SqlmapConnectionException(getSafeExString(ex))
|
||||||
|
|
||||||
|
self.initCursor()
|
||||||
|
self.printConnected()
|
||||||
|
|
||||||
|
def fetchall(self):
|
||||||
|
try:
|
||||||
|
return self.cursor.fetchall()
|
||||||
|
except Exception as ex:
|
||||||
|
logger.log(logging.WARNING if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex))
|
||||||
|
return None
|
||||||
|
|
||||||
|
def execute(self, query):
|
||||||
|
try:
|
||||||
|
self.cursor.execute(getText(query))
|
||||||
|
except Exception as ex:
|
||||||
|
logger.log(logging.WARNING if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex))
|
||||||
|
return None
|
||||||
|
|
||||||
|
def select(self, query):
|
||||||
|
self.execute(query)
|
||||||
|
return self.fetchall()
|
||||||
39
plugins/dbms/snowflake/enumeration.py
Normal file
39
plugins/dbms/snowflake/enumeration.py
Normal file
|
|
@ -0,0 +1,39 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2025 sqlmap developers (https://sqlmap.org)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
from lib.core.data import logger
|
||||||
|
from lib.core.exception import SqlmapUnsupportedFeatureException
|
||||||
|
from plugins.generic.enumeration import Enumeration as GenericEnumeration
|
||||||
|
|
||||||
|
class Enumeration(GenericEnumeration):
|
||||||
|
def getPasswordHashes(self):
|
||||||
|
warnMsg = "on Snowflake it is not possible to enumerate the user password hashes"
|
||||||
|
logger.warning(warnMsg)
|
||||||
|
return {}
|
||||||
|
|
||||||
|
def getHostname(self):
|
||||||
|
warnMsg = "on Snowflake it is not possible to enumerate the hostname"
|
||||||
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
|
def searchDb(self):
|
||||||
|
warnMsg = "on Snowflake it is not possible to search databases"
|
||||||
|
logger.warning(warnMsg)
|
||||||
|
return []
|
||||||
|
|
||||||
|
def searchColumn(self):
|
||||||
|
errMsg = "on Snowflake it is not possible to search columns"
|
||||||
|
raise SqlmapUnsupportedFeatureException(errMsg)
|
||||||
|
|
||||||
|
def getPrivileges(self, *args, **kwargs):
|
||||||
|
warnMsg = "on SQLite it is not possible to enumerate the user privileges"
|
||||||
|
logger.warning(warnMsg)
|
||||||
|
return {}
|
||||||
|
|
||||||
|
def getStatements(self):
|
||||||
|
warnMsg = "on Snowflake it is not possible to enumerate the SQL statements"
|
||||||
|
logger.warning(warnMsg)
|
||||||
|
return []
|
||||||
18
plugins/dbms/snowflake/filesystem.py
Normal file
18
plugins/dbms/snowflake/filesystem.py
Normal file
|
|
@ -0,0 +1,18 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2025 sqlmap developers (https://sqlmap.org)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
from lib.core.exception import SqlmapUnsupportedFeatureException
|
||||||
|
from plugins.generic.filesystem import Filesystem as GenericFilesystem
|
||||||
|
|
||||||
|
class Filesystem(GenericFilesystem):
|
||||||
|
def readFile(self, remoteFile):
|
||||||
|
errMsg = "on Snowflake it is not possible to read files"
|
||||||
|
raise SqlmapUnsupportedFeatureException(errMsg)
|
||||||
|
|
||||||
|
def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False):
|
||||||
|
errMsg = "on Snowflake it is not possible to write files"
|
||||||
|
raise SqlmapUnsupportedFeatureException(errMsg)
|
||||||
96
plugins/dbms/snowflake/fingerprint.py
Normal file
96
plugins/dbms/snowflake/fingerprint.py
Normal file
|
|
@ -0,0 +1,96 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2025 sqlmap developers (https://sqlmap.org)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
from lib.core.common import Backend
|
||||||
|
from lib.core.common import Format
|
||||||
|
from lib.core.data import conf
|
||||||
|
from lib.core.data import kb
|
||||||
|
from lib.core.data import logger
|
||||||
|
from lib.core.enums import DBMS
|
||||||
|
from lib.core.session import setDbms
|
||||||
|
from lib.core.settings import METADB_SUFFIX
|
||||||
|
from lib.core.settings import SNOWFLAKE_ALIASES
|
||||||
|
from lib.request import inject
|
||||||
|
from plugins.generic.fingerprint import Fingerprint as GenericFingerprint
|
||||||
|
|
||||||
|
class Fingerprint(GenericFingerprint):
|
||||||
|
def __init__(self):
|
||||||
|
GenericFingerprint.__init__(self, DBMS.SNOWFLAKE)
|
||||||
|
|
||||||
|
def getFingerprint(self):
|
||||||
|
value = ""
|
||||||
|
wsOsFp = Format.getOs("web server", kb.headersFp)
|
||||||
|
|
||||||
|
if wsOsFp:
|
||||||
|
value += "%s\n" % wsOsFp
|
||||||
|
|
||||||
|
if kb.data.banner:
|
||||||
|
dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp)
|
||||||
|
|
||||||
|
if dbmsOsFp:
|
||||||
|
value += "%s\n" % dbmsOsFp
|
||||||
|
|
||||||
|
value += "back-end DBMS: "
|
||||||
|
|
||||||
|
if not conf.extensiveFp:
|
||||||
|
value += DBMS.SNOWFLAKE
|
||||||
|
return value
|
||||||
|
|
||||||
|
actVer = Format.getDbms()
|
||||||
|
blank = " " * 15
|
||||||
|
value += "active fingerprint: %s" % actVer
|
||||||
|
|
||||||
|
if kb.bannerFp:
|
||||||
|
banVer = kb.bannerFp.get("dbmsVersion")
|
||||||
|
|
||||||
|
if banVer:
|
||||||
|
banVer = Format.getDbms([banVer])
|
||||||
|
value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer)
|
||||||
|
|
||||||
|
htmlErrorFp = Format.getErrorParsedDBMSes()
|
||||||
|
|
||||||
|
if htmlErrorFp:
|
||||||
|
value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
|
||||||
|
|
||||||
|
return value
|
||||||
|
|
||||||
|
def checkDbms(self):
|
||||||
|
"""
|
||||||
|
References for fingerprint:
|
||||||
|
|
||||||
|
* https://docs.snowflake.com/en/sql-reference/functions/current_warehouse
|
||||||
|
* https://docs.snowflake.com/en/sql-reference/functions/md5_number_upper64
|
||||||
|
"""
|
||||||
|
|
||||||
|
if not conf.extensiveFp and Backend.isDbmsWithin(SNOWFLAKE_ALIASES):
|
||||||
|
setDbms("%s %s" % (DBMS.SNOWFLAKE, Backend.getVersion()))
|
||||||
|
self.getBanner()
|
||||||
|
return True
|
||||||
|
|
||||||
|
infoMsg = "testing %s" % DBMS.SNOWFLAKE
|
||||||
|
logger.info(infoMsg)
|
||||||
|
|
||||||
|
result = inject.checkBooleanExpression("CURRENT_WAREHOUSE()=CURRENT_WAREHOUSE()")
|
||||||
|
if result:
|
||||||
|
infoMsg = "confirming %s" % DBMS.SNOWFLAKE
|
||||||
|
logger.info(infoMsg)
|
||||||
|
|
||||||
|
result = inject.checkBooleanExpression("MD5_NUMBER_UPPER64('z')=MD5_NUMBER_UPPER64('z')")
|
||||||
|
if not result:
|
||||||
|
warnMsg = "the back-end DBMS is not %s" % DBMS.SNOWFLAKE
|
||||||
|
logger.warning(warnMsg)
|
||||||
|
return False
|
||||||
|
|
||||||
|
setDbms(DBMS.SNOWFLAKE)
|
||||||
|
self.getBanner()
|
||||||
|
return True
|
||||||
|
|
||||||
|
else:
|
||||||
|
warnMsg = "the back-end DBMS is not %s" % DBMS.SNOWFLAKE
|
||||||
|
logger.warning(warnMsg)
|
||||||
|
|
||||||
|
return False
|
||||||
23
plugins/dbms/snowflake/syntax.py
Normal file
23
plugins/dbms/snowflake/syntax.py
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2025 sqlmap developers (https://sqlmap.org)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
from lib.core.convert import getOrds
|
||||||
|
from plugins.generic.syntax import Syntax as GenericSyntax
|
||||||
|
|
||||||
|
class Syntax(GenericSyntax):
|
||||||
|
@staticmethod
|
||||||
|
def escape(expression, quote=True):
|
||||||
|
"""
|
||||||
|
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar"
|
||||||
|
True
|
||||||
|
"""
|
||||||
|
|
||||||
|
def escaper(value):
|
||||||
|
# Convert each character to its ASCII code and wrap with CHR()
|
||||||
|
return "||".join(f"CHR({ord(c)})" for c in value)
|
||||||
|
|
||||||
|
return Syntax._escape(expression, quote, escaper)
|
||||||
28
plugins/dbms/snowflake/takeover.py
Normal file
28
plugins/dbms/snowflake/takeover.py
Normal file
|
|
@ -0,0 +1,28 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
"""
|
||||||
|
Copyright (c) 2006-2025 sqlmap developers (https://sqlmap.org)
|
||||||
|
See the file 'LICENSE' for copying permission
|
||||||
|
"""
|
||||||
|
|
||||||
|
from lib.core.exception import SqlmapUnsupportedFeatureException
|
||||||
|
from plugins.generic.takeover import Takeover as GenericTakeover
|
||||||
|
|
||||||
|
class Takeover(GenericTakeover):
|
||||||
|
def osCmd(self):
|
||||||
|
errMsg = "on Snowflake it is not possible to execute commands"
|
||||||
|
raise SqlmapUnsupportedFeatureException(errMsg)
|
||||||
|
|
||||||
|
def osShell(self):
|
||||||
|
errMsg = "on Snowflake it is not possible to execute commands"
|
||||||
|
raise SqlmapUnsupportedFeatureException(errMsg)
|
||||||
|
|
||||||
|
def osPwn(self):
|
||||||
|
errMsg = "on Snowflake it is not possible to establish an "
|
||||||
|
errMsg += "out-of-band connection"
|
||||||
|
raise SqlmapUnsupportedFeatureException(errMsg)
|
||||||
|
|
||||||
|
def osSmb(self):
|
||||||
|
errMsg = "on Snowflake it is not possible to establish an "
|
||||||
|
errMsg += "out-of-band connection"
|
||||||
|
raise SqlmapUnsupportedFeatureException(errMsg)
|
||||||
|
|
@ -621,7 +621,7 @@ class Databases(object):
|
||||||
condQueryStr = "%%s%s" % colCondParam
|
condQueryStr = "%%s%s" % colCondParam
|
||||||
condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList))
|
condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList))
|
||||||
|
|
||||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, DBMS.FRONTBASE, DBMS.VIRTUOSO, DBMS.CLICKHOUSE):
|
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, DBMS.FRONTBASE, DBMS.VIRTUOSO, DBMS.CLICKHOUSE, DBMS.SNOWFLAKE):
|
||||||
query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db))
|
query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db))
|
||||||
query += condQuery
|
query += condQuery
|
||||||
|
|
||||||
|
|
@ -757,7 +757,7 @@ class Databases(object):
|
||||||
condQueryStr = "%%s%s" % colCondParam
|
condQueryStr = "%%s%s" % colCondParam
|
||||||
condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList))
|
condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList))
|
||||||
|
|
||||||
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, DBMS.FRONTBASE, DBMS.VIRTUOSO, DBMS.CLICKHOUSE):
|
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, DBMS.FRONTBASE, DBMS.VIRTUOSO, DBMS.CLICKHOUSE, DBMS.SNOWFLAKE):
|
||||||
query = rootQuery.blind.count % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db))
|
query = rootQuery.blind.count % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db))
|
||||||
query += condQuery
|
query += condQuery
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -187,7 +187,7 @@ class Entries(object):
|
||||||
|
|
||||||
if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE, DBMS.MIMERSQL):
|
if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE, DBMS.MIMERSQL):
|
||||||
query = rootQuery.inband.query % (colString, tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper())))
|
query = rootQuery.inband.query % (colString, tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper())))
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD, DBMS.MAXDB, DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA):
|
elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD, DBMS.MAXDB, DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA, DBMS.SNOWFLAKE):
|
||||||
query = rootQuery.inband.query % (colString, tbl)
|
query = rootQuery.inband.query % (colString, tbl)
|
||||||
elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL):
|
elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL):
|
||||||
# Partial inband and error
|
# Partial inband and error
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue
Block a user