diff --git a/lib/core/settings.py b/lib/core/settings.py index d3c15b876..d86cc6dd4 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.8.34" +VERSION = "1.10.8.35" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/tamper/between.py b/tamper/between.py index 5b289cb8a..9999d5db1 100644 --- a/tamper/between.py +++ b/tamper/between.py @@ -19,16 +19,18 @@ def tamper(payload, **kwargs): Replaces the greater-than operator (>) with NOT BETWEEN 0 AND # and the equal sign (=) with BETWEEN # AND # Tested against: - * Microsoft SQL Server 2005 - * MySQL 4, 5.0 and 5.5 - * Oracle 10g - * PostgreSQL 8.3, 8.4, 9.0 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass weak and bespoke web application firewalls that filter the greater than character - * The BETWEEN clause is SQL standard. Hence, this tamper script - should work against all (?) databases + * The BETWEEN clause is SQL standard, and the rewrite was confirmed + to run unchanged on every engine listed above >>> tamper('1 AND A > B--') '1 AND A NOT BETWEEN 0 AND B--' diff --git a/tamper/commalesslimit.py b/tamper/commalesslimit.py index 6361a7563..73630b020 100644 --- a/tamper/commalesslimit.py +++ b/tamper/commalesslimit.py @@ -23,9 +23,19 @@ def tamper(payload, **kwargs): Requirement: * MySQL + * MariaDB + * SQLite Tested against: - * MySQL 5.0 and 5.5 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * SQLite 3.45.1 + + Notes: + * Applicability is set by the 'LIMIT M, N' input form, which only MySQL, + MariaDB and SQLite accept. PostgreSQL rejects it (it takes solely the + 'LIMIT N OFFSET M' form this script produces), so the script never has + anything to rewrite there >>> tamper('LIMIT 2, 3') 'LIMIT 3 OFFSET 2' diff --git a/tamper/commentbeforeparentheses.py b/tamper/commentbeforeparentheses.py index a3fbf33b5..6d1c8d3e3 100644 --- a/tamper/commentbeforeparentheses.py +++ b/tamper/commentbeforeparentheses.py @@ -19,10 +19,12 @@ def tamper(payload, **kwargs): Prepends (inline) comment before parentheses (e.g. ( -> /**/() Tested against: - * Microsoft SQL Server - * MySQL - * Oracle - * PostgreSQL + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass web application firewalls that block usage diff --git a/tamper/equaltolike.py b/tamper/equaltolike.py index a4f8fa1c5..f61267aa4 100644 --- a/tamper/equaltolike.py +++ b/tamper/equaltolike.py @@ -18,15 +18,27 @@ def tamper(payload, **kwargs): """ Replaces all occurrences of operator equal ('=') with 'LIKE' counterpart + Requirement: + * MySQL + * MariaDB + * SQLite + * Microsoft SQL Server + * Oracle + Tested against: - * Microsoft SQL Server 2005 - * MySQL 4, 5.0 and 5.5 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass weak and bespoke web application firewalls that filter the equal character ('=') - * The LIKE operator is SQL standard. Hence, this tamper script - should work against all (?) databases + * NOT usable against PostgreSQL, which refuses to compare a numeric + operand with LIKE (e.g. '1 LIKE 1' raises 'operator does not exist: + integer ~~ integer'), unlike the engines listed above which coerce + the operands to text >>> tamper('SELECT * FROM users WHERE id=1') 'SELECT * FROM users WHERE id LIKE 1' diff --git a/tamper/greatest.py b/tamper/greatest.py index 742b090c1..d50e94a81 100644 --- a/tamper/greatest.py +++ b/tamper/greatest.py @@ -18,16 +18,26 @@ def tamper(payload, **kwargs): """ Replaces greater than operator ('>') with 'GREATEST' counterpart + Requirement: + * MySQL + * MariaDB + * PostgreSQL + * Microsoft SQL Server >= 2022 + * Oracle + Tested against: - * MySQL 4, 5.0 and 5.5 - * Oracle 10g - * PostgreSQL 8.3, 8.4, 9.0 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass weak and bespoke web application firewalls that filter the greater than character - * The GREATEST clause is a widespread SQL command. Hence, this - tamper script should work against majority of databases + * NOT usable against SQLite, which has no GREATEST() (it overloads + MAX() for the multi-argument case instead). Microsoft SQL Server + only gained GREATEST() in 2022 >>> tamper('1 AND A > B') '1 AND GREATEST(A,B+1)=A' diff --git a/tamper/if2case.py b/tamper/if2case.py index 029c130b9..fe875f83d 100644 --- a/tamper/if2case.py +++ b/tamper/if2case.py @@ -48,15 +48,18 @@ def tamper(payload, **kwargs): Requirement: * MySQL - * SQLite (possibly) - * SAP MaxDB (possibly) + * MariaDB Tested against: - * MySQL 5.0 and 5.5 + * MySQL 8.4.9 + * MariaDB 11.8.8 Notes: * Useful to bypass very weak and bespoke web application firewalls that filter the IF() functions + * The CASE replacement itself is standard SQL and runs anywhere, but the + 'IF(A, B, C)' input form is MySQL/MariaDB-only (SQLite, for one, has no + IF() function), so there is nothing to rewrite on other engines >>> tamper('IF(1, 2, 3)') 'CASE WHEN (1) THEN (2) ELSE (3) END' diff --git a/tamper/ifnull2casewhenisnull.py b/tamper/ifnull2casewhenisnull.py index 9d94e4671..e37f21787 100644 --- a/tamper/ifnull2casewhenisnull.py +++ b/tamper/ifnull2casewhenisnull.py @@ -19,15 +19,17 @@ def tamper(payload, **kwargs): Requirement: * MySQL - * SQLite (possibly) - * SAP MaxDB (possibly) + * MariaDB Tested against: - * MySQL 5.0 and 5.5 + * MySQL 8.4.9 + * MariaDB 11.8.8 Notes: * Useful to bypass very weak and bespoke web application firewalls that filter the IFNULL() functions + * NOT usable against SQLite, despite it having IFNULL(): the replacement + needs ISNULL(), which SQLite does not provide >>> tamper('IFNULL(1, 2)') 'CASE WHEN ISNULL(1) THEN (2) ELSE (1) END' diff --git a/tamper/ifnull2ifisnull.py b/tamper/ifnull2ifisnull.py index 3ede6ac35..778489f05 100644 --- a/tamper/ifnull2ifisnull.py +++ b/tamper/ifnull2ifisnull.py @@ -19,15 +19,17 @@ def tamper(payload, **kwargs): Requirement: * MySQL - * SQLite (possibly) - * SAP MaxDB (possibly) + * MariaDB Tested against: - * MySQL 5.0 and 5.5 + * MySQL 8.4.9 + * MariaDB 11.8.8 Notes: * Useful to bypass very weak and bespoke web application firewalls that filter the IFNULL() function + * NOT usable against SQLite, despite it having IFNULL(): the replacement + needs both IF() and ISNULL(), neither of which SQLite provides >>> tamper('IFNULL(1, 2)') 'IF(ISNULL(1),2,1)' diff --git a/tamper/least.py b/tamper/least.py index a4f84a5a9..8a7a81bbe 100644 --- a/tamper/least.py +++ b/tamper/least.py @@ -18,16 +18,26 @@ def tamper(payload, **kwargs): """ Replaces greater than operator ('>') with 'LEAST' counterpart + Requirement: + * MySQL + * MariaDB + * PostgreSQL + * Microsoft SQL Server >= 2022 + * Oracle + Tested against: - * MySQL 4, 5.0 and 5.5 - * Oracle 10g - * PostgreSQL 8.3, 8.4, 9.0 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass weak and bespoke web application firewalls that filter the greater than character - * The LEAST clause is a widespread SQL command. Hence, this - tamper script should work against majority of databases + * NOT usable against SQLite, which has no LEAST() (it overloads + MIN() for the multi-argument case instead). Microsoft SQL Server + only gained LEAST() in 2022 >>> tamper('1 AND A > B') '1 AND LEAST(A,B+1)=B+1' diff --git a/tamper/lowercase.py b/tamper/lowercase.py index ab0fa2e9a..9cc731432 100644 --- a/tamper/lowercase.py +++ b/tamper/lowercase.py @@ -20,10 +20,12 @@ def tamper(payload, **kwargs): Replaces each keyword character with lower case value (e.g. SELECT -> select) Tested against: - * Microsoft SQL Server 2005 - * MySQL 4, 5.0 and 5.5 - * Oracle 10g - * PostgreSQL 8.3, 8.4, 9.0 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass very weak and bespoke web application firewalls diff --git a/tamper/multiplespaces.py b/tamper/multiplespaces.py index ab02a0c91..07e56d2de 100644 --- a/tamper/multiplespaces.py +++ b/tamper/multiplespaces.py @@ -21,6 +21,14 @@ def tamper(payload, **kwargs): """ Adds multiple spaces (' ') around SQL keywords + Tested against: + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai + Notes: * Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions diff --git a/tamper/randomcase.py b/tamper/randomcase.py index 9535444cc..6d6fac626 100644 --- a/tamper/randomcase.py +++ b/tamper/randomcase.py @@ -22,16 +22,17 @@ def tamper(payload, **kwargs): Replaces each keyword character with random case value (e.g. SELECT -> SEleCt) Tested against: - * Microsoft SQL Server 2005 - * MySQL 4, 5.0 and 5.5 - * Oracle 10g - * PostgreSQL 8.3, 8.4, 9.0 - * SQLite 3 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions - * This tamper script should work against all (?) databases + * Keyword case is insignificant on every engine listed above >>> import random >>> random.seed(0) diff --git a/tamper/sign.py b/tamper/sign.py index ff15c5c8e..33e6593ec 100644 --- a/tamper/sign.py +++ b/tamper/sign.py @@ -19,10 +19,12 @@ def tamper(payload, **kwargs): Replaces greater than operator ('>') with 'SIGN' counterpart (e.g. SIGN((A)-(B))=1) Tested against: - * MySQL 5 - * Oracle 11g - * PostgreSQL 9 - * Microsoft SQL Server 2012 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass filtering of comparison operators altogether (>, <, diff --git a/tamper/space2comment.py b/tamper/space2comment.py index 016b17cc6..7026bbe9a 100644 --- a/tamper/space2comment.py +++ b/tamper/space2comment.py @@ -18,10 +18,12 @@ def tamper(payload, **kwargs): Replaces space character (' ') with comments '/**/' Tested against: - * Microsoft SQL Server 2005 - * MySQL 4, 5.0 and 5.5 - * Oracle 10g - * PostgreSQL 8.3, 8.4, 9.0 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass weak and bespoke web application firewalls diff --git a/tamper/space2morecomment.py b/tamper/space2morecomment.py index 9db2791c9..f309ea58d 100644 --- a/tamper/space2morecomment.py +++ b/tamper/space2morecomment.py @@ -18,10 +18,17 @@ def tamper(payload, **kwargs): Replaces (MySQL) instances of space character (' ') with comments '/**_**/' Tested against: - * MySQL 5.0 and 5.5 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass weak and bespoke web application firewalls + * Despite the script's name, '/**_**/' is a valid comment on every engine + listed above, not just MySQL >>> tamper('SELECT id FROM users') 'SELECT/**_**/id/**_**/FROM/**_**/users' diff --git a/tamper/unionalltounion.py b/tamper/unionalltounion.py index c8007d67c..ab60ecaf2 100644 --- a/tamper/unionalltounion.py +++ b/tamper/unionalltounion.py @@ -18,6 +18,14 @@ def tamper(payload, **kwargs): """ Replaces instances of UNION ALL SELECT with UNION SELECT counterpart + Tested against: + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai + >>> tamper('-1 UNION ALL SELECT') '-1 UNION SELECT' """ diff --git a/tamper/uppercase.py b/tamper/uppercase.py index 81774a999..ea4e6ee45 100644 --- a/tamper/uppercase.py +++ b/tamper/uppercase.py @@ -20,15 +20,17 @@ def tamper(payload, **kwargs): Replaces each keyword character with upper case value (e.g. select -> SELECT) Tested against: - * Microsoft SQL Server 2005 - * MySQL 4, 5.0 and 5.5 - * Oracle 10g - * PostgreSQL 8.3, 8.4, 9.0 + * MySQL 8.4.9 + * MariaDB 11.8.8 + * PostgreSQL 16.11 + * SQLite 3.45.1 + * Microsoft SQL Server 2022 + * Oracle 23ai Notes: * Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions - * This tamper script should work against all (?) databases + * Keyword case is insignificant on every engine listed above >>> tamper('insert') 'INSERT'