Merge branch 'master' into hana-pr

# Conflicts:
#	data/txt/sha256sums.txt
#	lib/core/common.py
#	lib/core/settings.py

plugins/dbms/monetdb/fingerprint.py

@@ -68,7 +68,7 @@ class Fingerprint(GenericFingerprint):
         infoMsg = "testing %s" % DBMS.MONETDB
         logger.info(infoMsg)
 
-        result = inject.checkBooleanExpression("isaurl(NULL)=false")
+        result = inject.checkBooleanExpression("isaurl(NULL) IS NULL")
 
         if result:
             infoMsg = "confirming %s" % DBMS.MONETDB

plugins/dbms/mssqlserver/enumeration.py

@@ -93,7 +93,7 @@ class Enumeration(GenericEnumeration):
 
         if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
             for db in dbs:
-                if conf.excludeSysDbs and db in self.excludeDbsList:
+                if conf.excludeSysDbs and unsafeSQLIdentificatorNaming(db) in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % db
                     singleTimeLogMessage(infoMsg)
                     continue
@@ -116,7 +116,7 @@ class Enumeration(GenericEnumeration):
 
         if not kb.data.cachedTables and isInferenceAvailable() and not conf.direct:
             for db in dbs:
-                if conf.excludeSysDbs and db in self.excludeDbsList:
+                if conf.excludeSysDbs and unsafeSQLIdentificatorNaming(db) in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % db
                     singleTimeLogMessage(infoMsg)
                     continue
@@ -206,7 +206,7 @@ class Enumeration(GenericEnumeration):
             for db in foundTbls.keys():
                 db = safeSQLIdentificatorNaming(db)
 
-                if conf.excludeSysDbs and db in self.excludeDbsList:
+                if conf.excludeSysDbs and unsafeSQLIdentificatorNaming(db) in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % db
                     singleTimeLogMessage(infoMsg)
                     continue
@@ -343,7 +343,7 @@ class Enumeration(GenericEnumeration):
             for db in (_ for _ in dbs if _):
                 db = safeSQLIdentificatorNaming(db)
 
-                if conf.excludeSysDbs and db in self.excludeDbsList:
+                if conf.excludeSysDbs and unsafeSQLIdentificatorNaming(db) in self.excludeDbsList:
                     continue
 
                 if conf.exclude and re.search(conf.exclude, db, re.I) is not None:

plugins/dbms/mssqlserver/takeover.py

@@ -61,7 +61,7 @@ class Takeover(GenericTakeover):
                 break
 
         if not addrs:
-            errMsg = "sqlmap can not exploit the stored procedure buffer "
+            errMsg = "sqlmap cannot exploit the stored procedure buffer "
             errMsg += "overflow because it does not have a valid return "
             errMsg += "code for the underlying operating system (Windows "
             errMsg += "%s Service Pack %d)" % (Backend.getOsVersion(), Backend.getOsServicePack())

plugins/dbms/oracle/syntax.py

@@ -16,6 +16,8 @@ class Syntax(GenericSyntax):
         True
         >>> Syntax.escape(u"SELECT 'abcd\xebfgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||NCHR(235)||CHR(102)||CHR(103)||CHR(104) FROM foobar"
         True
+        >>> Syntax.escape("SELECT 'a''b' FROM DUAL") == "SELECT CHR(97)||CHR(39)||CHR(98) FROM DUAL"
+        True
         """
 
         def escaper(value):

plugins/dbms/postgresql/filesystem.py

@@ -11,6 +11,7 @@ from lib.core.common import randomInt
 from lib.core.compat import xrange
 from lib.core.data import kb
 from lib.core.data import logger
+from lib.core.enums import CHARSET_TYPE
 from lib.core.exception import SqlmapUnsupportedFeatureException
 from lib.core.settings import LOBLKSIZE
 from lib.request import inject
@@ -32,6 +33,15 @@ class Filesystem(GenericFilesystem):
 
         return self.udfEvalCmd(cmd=remoteFile, udfName="sys_fileread")
 
+    def nonStackedReadFile(self, remoteFile):
+        if not kb.bruteMode:
+            infoMsg = "fetching file: '%s'" % remoteFile
+            logger.info(infoMsg)
+
+        # a superuser (or a member of the pg_read_server_files role on PostgreSQL >= 11) can read
+        # files in-band via pg_read_binary_file(), so file reading does not require stacked queries
+        return inject.getValue("ENCODE(PG_READ_BINARY_FILE('%s'),'hex')" % remoteFile, charsetType=CHARSET_TYPE.HEXADECIMAL)
+
     def unionWriteFile(self, localFile, remoteFile, fileType=None, forceCheck=False):
         errMsg = "PostgreSQL does not support file upload with UNION "
         errMsg += "query SQL injection technique"

plugins/dbms/presto/enumeration.py

@@ -9,15 +9,8 @@ from lib.core.data import logger
 from plugins.generic.enumeration import Enumeration as GenericEnumeration
 
 class Enumeration(GenericEnumeration):
-    def getBanner(self):
-        warnMsg = "on Presto it is not possible to get the banner"
-        logger.warning(warnMsg)
-
-        return None
-
-    def getCurrentDb(self):
-        warnMsg = "on Presto it is not possible to get name of the current database (schema)"
-        logger.warning(warnMsg)
+    # NOTE: getBanner()/getCurrentDb() are intentionally NOT overridden - modern Presto/Trino expose
+    # version() and current_schema (wired in queries.xml), so the generic implementations work.
 
     def isDba(self, user=None):
         warnMsg = "on Presto it is not possible to test if current user is DBA"

plugins/dbms/presto/fingerprint.py

@@ -7,10 +7,14 @@ See the file 'LICENSE' for copying permission
 
 from lib.core.common import Backend
 from lib.core.common import Format
+from lib.core.common import hashDBRetrieve
+from lib.core.common import hashDBWrite
 from lib.core.data import conf
 from lib.core.data import kb
 from lib.core.data import logger
 from lib.core.enums import DBMS
+from lib.core.enums import FORK
+from lib.core.enums import HASHDB_KEYS
 from lib.core.session import setDbms
 from lib.core.settings import PRESTO_ALIASES
 from lib.request import inject
@@ -21,6 +25,18 @@ class Fingerprint(GenericFingerprint):
         GenericFingerprint.__init__(self, DBMS.PRESTO)
 
     def getFingerprint(self):
+        fork = hashDBRetrieve(HASHDB_KEYS.DBMS_FORK)
+
+        if fork is None:
+            # Trino (the PrestoSQL fork) exposes functions PrestoDB never added (e.g. SOUNDEX),
+            # so a NULL-based probe on one of them distinguishes the fork from the original.
+            if inject.checkBooleanExpression("SOUNDEX(NULL) IS NULL"):
+                fork = FORK.TRINO
+            else:
+                fork = ""
+
+            hashDBWrite(HASHDB_KEYS.DBMS_FORK, fork)
+
         value = ""
         wsOsFp = Format.getOs("web server", kb.headersFp)
 
@@ -37,6 +53,8 @@ class Fingerprint(GenericFingerprint):
 
         if not conf.extensiveFp:
             value += DBMS.PRESTO
+            if fork:
+                value += " (%s fork)" % fork
             return value
 
         actVer = Format.getDbms()
@@ -55,6 +73,9 @@ class Fingerprint(GenericFingerprint):
         if htmlErrorFp:
             value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
 
+        if fork:
+            value += "\n%sfork fingerprint: %s" % (blank, fork)
+
         return value
 
     def checkDbms(self):