Skip to content

Commit 95560da

Browse files
stamparmstamparm
committed
Implements #1222 
1 parent 0043593 commit 95560da

18 files changed

Lines changed: 169 additions & 3 deletions

File tree

‎data/xml/queries.xml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@
4141
<blind query="SELECT DISTINCT(privilege_type) FROM INFORMATION_SCHEMA.USER_PRIVILEGES WHERE grantee %s '%s' LIMIT %d,1" query2="SELECT select_priv,insert_priv,update_priv,delete_priv,create_priv,drop_priv,reload_priv,shutdown_priv,process_priv,file_priv,grant_priv,references_priv,index_priv,alter_priv,show_db_priv,super_priv,create_tmp_table_priv,lock_tables_priv,execute_priv,repl_slave_priv,repl_client_priv,create_view_priv,show_view_priv,create_routine_priv,alter_routine_priv,create_user_priv FROM mysql.user WHERE user='%s' LIMIT %d,1" count="SELECT COUNT(DISTINCT(privilege_type)) FROM INFORMATION_SCHEMA.USER_PRIVILEGES WHERE grantee %s '%s'" count2="SELECT COUNT(*) FROM mysql.user WHERE user='%s'"/>
4242
</privileges>
4343
<roles/>
44+
<statements>
45+
<inband query="SELECT INFO FROM INFORMATION_SCHEMA.PROCESSLIST"/>
46+
<blind query="SELECT INFO FROM INFORMATION_SCHEMA.PROCESSLIST ORDER BY ID LIMIT %d,1" query2="SELECT INFO FROM INFORMATION_SCHEMA.PROCESSLIST WHERE ID=%d" query3="SELECT ID FROM INFORMATION_SCHEMA.PROCESSLIST LIMIT %d,1" count="SELECT COUNT(DISTINCT(INFO)) FROM INFORMATION_SCHEMA.PROCESSLIST"/>
47+
</statements>
4448
<dbs>
4549
<inband query="SELECT schema_name FROM INFORMATION_SCHEMA.SCHEMATA" query2="SELECT db FROM mysql.db"/>
4650
<blind query="SELECT DISTINCT(schema_name) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT %d,1" query2="SELECT DISTINCT(db) FROM mysql.db LIMIT %d,1" count="SELECT COUNT(DISTINCT(schema_name)) FROM INFORMATION_SCHEMA.SCHEMATA" count2="SELECT COUNT(DISTINCT(db)) FROM mysql.db"/>
@@ -112,6 +116,10 @@
112116
<blind query="SELECT (CASE WHEN usecreatedb THEN 1 ELSE 0 END),(CASE WHEN usesuper THEN 1 ELSE 0 END),(CASE WHEN usecatupd THEN 1 ELSE 0 END) FROM pg_user WHERE usename='%s' OFFSET %d LIMIT 1" count="SELECT COUNT(DISTINCT(usename)) FROM pg_user WHERE usename='%s'"/>
113117
</privileges>
114118
<roles/>
119+
<statements>
120+
<inband query="SELECT query FROM pg_stat_activity WHERE query != '&lt;IDLE&gt;'"/>
121+
<blind query="SELECT DISTINCT(query) FROM pg_stat_activity WHERE query != '&lt;IDLE&gt;' OFFSET %d LIMIT 1" count="SELECT COUNT(DISTINCT(query)) FROM pg_stat_activity WHERE query != '&lt;IDLE&gt;'"/>
122+
</statements>
115123
<dbs>
116124
<inband query="SELECT schemaname FROM pg_tables"/>
117125
<blind query="SELECT DISTINCT(schemaname) FROM pg_tables OFFSET %d LIMIT 1" count="SELECT COUNT(DISTINCT(schemaname)) FROM pg_tables"/>
@@ -180,6 +188,10 @@
180188
<!-- NOTE: in Microsoft SQL Server there is no query to enumerate DBMS users privileges -->
181189
<privileges/>
182190
<roles/>
191+
<statements>
192+
<inband query="SELECT st.text FROM sys.dm_exec_cached_plans cp CROSS APPLY sys.dm_exec_sql_text(cp.plan_handle) st"/>
193+
<blind query="SELECT TOP 1 a.text FROM sys.dm_exec_cached_plans cp CROSS APPLY sys.dm_exec_sql_text(cp.plan_handle) a WHERE a.text NOT IN (SELECT TOP %d b.text FROM sys.dm_exec_cached_plans cp CROSS APPLY sys.dm_exec_sql_text(cp.plan_handle) b ORDER BY b.text) ORDER BY a.text" count="SELECT LTRIM(STR(COUNT(st.text))) FROM sys.dm_exec_cached_plans cp CROSS APPLY sys.dm_exec_sql_text(cp.plan_handle) st"/>
194+
</statements>
183195
<dbs>
184196
<inband query="SELECT name FROM master..sysdatabases" query2="SELECT DB_NAME(%d)"/>
185197
<blind query="SELECT TOP 1 name FROM master..sysdatabases WHERE name NOT IN (SELECT TOP %d name FROM master..sysdatabases ORDER BY name) ORDER BY name" count="SELECT LTRIM(STR(COUNT(name))) FROM master..sysdatabases"/>
@@ -268,6 +280,10 @@
268280
<inband query="SELECT GRANTEE,GRANTED_ROLE FROM DBA_ROLE_PRIVS" query2="SELECT USERNAME,GRANTED_ROLE FROM USER_ROLE_PRIVS" condition="GRANTEE" condition2="USERNAME"/>
269281
<blind query="SELECT GRANTED_ROLE FROM (SELECT GRANTED_ROLE,ROWNUM AS LIMIT FROM DBA_ROLE_PRIVS WHERE GRANTEE='%s') WHERE LIMIT=%d" query2="SELECT GRANTED_ROLE FROM (SELECT GRANTED_ROLE,ROWNUM AS LIMIT FROM USER_ROLE_PRIVS WHERE USERNAME='%s') WHERE LIMIT=%d" count="SELECT COUNT(GRANTED_ROLE) FROM DBA_ROLE_PRIVS WHERE GRANTEE='%s'" count2="SELECT COUNT(GRANTED_ROLE) FROM USER_ROLE_PRIVS WHERE USERNAME='%s'"/>
270282
</roles>
283+
<statements>
284+
<inband query="SELECT SQL_TEXT FROM V$SQL"/>
285+
<blind query="SELECT SQL_TEXT FROM (SELECT SQL_TEXT,ROWNUM AS LIMIT FROM V$SQL WHERE SQL_TEXT NOT LIKE '%%SQL_TEXT%%') WHERE LIMIT=%d" count="SELECT COUNT(SQL_TEXT) FROM V$SQL WHERE SQL_TEXT NOT LIKE '%%SQL_TEXT%%'"/>
286+
</statements>
271287
<!-- NOTE: in Oracle schema names are the counterpart to database names on other DBMSes -->
272288
<dbs>
273289
<inband query="SELECT OWNER FROM (SELECT DISTINCT(OWNER) FROM SYS.ALL_TABLES)"/>
@@ -332,6 +348,7 @@
332348
<passwords/>
333349
<privileges/>
334350
<roles/>
351+
<statements/>
335352
<dbs/>
336353
<tables>
337354
<inband query="SELECT tbl_name FROM sqlite_master WHERE type='table'"/>
@@ -392,6 +409,7 @@
392409
<users/>
393410
<privileges/>
394411
<roles/>
412+
<statements/>
395413
<search_db/>
396414
<search_table/>
397415
<search_column/>
@@ -435,6 +453,7 @@
435453
<blind query="SELECT FIRST 1 SKIP %d DISTINCT(RDB$PRIVILEGE) FROM RDB$USER_PRIVILEGES WHERE RDB$USER='%s'" count="SELECT COUNT(DISTINCT(RDB$PRIVILEGE)) FROM RDB$USER_PRIVILEGES WHERE RDB$USER='%s'"/>
436454
</privileges>
437455
<roles/>
456+
<statements/>
438457
<dbs/>
439458
<columns>
440459
<!--<inband query="SELECT r.RDB$FIELD_NAME,CASE f.RDB$FIELD_TYPE WHEN 261 THEN 'BLOB' WHEN 14 THEN 'CHAR' WHEN 40 THEN 'CSTRING' WHEN 11 THEN 'D_FLOAT' WHEN 27 THEN 'DOUBLE' WHEN 10 THEN 'FLOAT' WHEN 16 THEN 'INT64' WHEN 8 THEN 'INTEGER' WHEN 9 THEN 'QUAD' WHEN 7 THEN 'SMALLINT' WHEN 12 THEN 'DATE' WHEN 13 THEN 'TIME' WHEN 35 THEN 'TIMESTAMP' WHEN 37 THEN 'VARCHAR' ELSE 'UNKNOWN' END AS field_type FROM RDB$RELATION_FIELDS r LEFT JOIN RDB$FIELDS f ON r.RDB$FIELD_SOURCE = f.RDB$FIELD_NAME WHERE r.RDB$RELATION_NAME='%s'"/>-->
@@ -504,6 +523,7 @@
504523
<inband query="SELECT owner,role FROM domain.roles" condition="owner"/>
505524
<blind/>
506525
</roles>
526+
<statements/>
507527
<dump_table>
508528
<inband query="SELECT %s FROM %%s"/>
509529
<blind query="SELECT MIN(%s) FROM %s WHERE CHR(%s)>'%s'" query2="SELECT MAX(%s) FROM %s WHERE CHR(%s) LIKE '%s'" count="SELECT COUNT(*) FROM %s" count2="SELECT COUNT(*) FROM (SELECT DISTINCT %s FROM %s) AS qq"/>
@@ -549,6 +569,7 @@
549569
<inband query="SELECT name,srid FROM master..syslogins,master..sysloginroles" condition="name"/>
550570
<blind/>
551571
</roles>
572+
<statements/>
552573
<dbs>
553574
<inband query="SELECT name FROM master..sysdatabases"/>
554575
<blind/>
@@ -620,6 +641,7 @@
620641
<blind query="SELECT tabschema||'.'||tabname||','||controlauth||alterauth||deleteauth||indexauth||insertauth||refauth||selectauth||updateauth FROM (SELECT ROW_NUMBER() OVER () AS LIMIT,syscat.tabauth.* FROM syscat.tabauth WHERE grantee='%s') AS qq WHERE LIMIT=%d" count="SELECT COUNT(*) FROM syscat.tabauth WHERE grantee='%s'"/>
621642
</privileges>
622643
<roles/>
644+
<statements/>
623645
<!-- NOTE: in DB2 schema names are the counterpart to database names on other DBMSes -->
624646
<dbs>
625647
<inband query="SELECT schemaname FROM syscat.schemata"/>
@@ -690,6 +712,7 @@
690712
</passwords>
691713
<privileges/>
692714
<roles/>
715+
<statements/>
693716
<dbs>
694717
<blind query="SELECT LIMIT %d 1 DISTINCT(table_schem) FROM INFORMATION_SCHEMA.SYSTEM_SCHEMAS ORDER BY table_schem" count="SELECT COUNT(table_schem) FROM INFORMATION_SCHEMA.SYSTEM_SCHEMAS"/>
695718
<inband query="SELECT table_schem FROM INFORMATION_SCHEMA.SYSTEM_SCHEMAS ORDER BY table_schem" />
@@ -753,6 +776,7 @@
753776
<passwords/>
754777
<privileges/>
755778
<roles/>
779+
<statements/>
756780
<dbs>
757781
<inband query="SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA"/>
758782
<blind query="SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA OFFSET %d LIMIT 1" count="SELECT COUNT(SCHEMA_NAME) FROM INFORMATION_SCHEMA.SCHEMATA"/>
@@ -825,6 +849,7 @@
825849
<blind query="SELECT USERTYPE FROM SYSUSERS WHERE USERNAME='%s'"/>
826850
</privileges>
827851
<roles/>
852+
<statements/>
828853
<dbs>
829854
<inband query="SELECT NAME FROM SYSMASTER:SYSDATABASES"/>
830855
<blind query="SELECT SKIP %d LIMIT 1 NAME FROM SYSMASTER:SYSDATABASES ORDER BY NAME" count="SELECT COUNT(NAME) FROM SYSMASTER:SYSDATABASES"/>

‎lib/controller/action.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@ def action():
7272
if conf.getUsers:
7373
conf.dumper.users(conf.dbmsHandler.getUsers())
7474

75+
if conf.getStatements:
76+
conf.dumper.statements(conf.dbmsHandler.getStatements())
77+
7578
if conf.getPasswordHashes:
7679
try:
7780
conf.dumper.userSettings("database management system users password hashes", conf.dbmsHandler.getPasswordHashes(), "password hash", CONTENT_TYPE.PASSWORDS)

‎lib/core/dump.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,9 @@ def dba(self, data):
188188
def users(self, users):
189189
self.lister("database management system users", users, content_type=CONTENT_TYPE.USERS)
190190

191+
def statements(self, statements):
192+
self.lister("SQL statements", statements, content_type=CONTENT_TYPE.STATEMENTS)
193+
191194
def userSettings(self, header, userSettings, subHeader, content_type=None):
192195
self._areAdmins = set()
193196

‎lib/core/enums.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -348,6 +348,7 @@ class CONTENT_TYPE:
348348
FILE_WRITE = 23
349349
OS_CMD = 24
350350
REG_READ = 25
351+
STATEMENTS = 26
351352

352353
class CONTENT_STATUS:
353354
IN_PROGRESS = 0

‎lib/core/optiondict.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,7 @@
139139
"dumpAll": "boolean",
140140
"search": "boolean",
141141
"getComments": "boolean",
142+
"getStatements": "boolean",
142143
"db": "string",
143144
"tbl": "string",
144145
"col": "string",

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
from thirdparty.six import unichr as _unichr
1919

2020
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
21-
VERSION = "1.3.5.151"
21+
VERSION = "1.3.5.152"
2222
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2323
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2424
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/parse/cmdline.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -417,6 +417,9 @@ def cmdLineParser(argv=None):
417417
enumeration.add_option("--comments", dest="getComments", action="store_true",
418418
help="Check for DBMS comments during enumeration")
419419

420+
enumeration.add_option("--statements", dest="getStatements", action="store_true",
421+
help="Retrieve SQL statements being run on DBMS")
422+
420423
enumeration.add_option("-D", dest="db",
421424
help="DBMS database to enumerate")
422425

‎plugins/dbms/access/enumeration.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,3 +76,9 @@ def search(self):
7676
def getHostname(self):
7777
warnMsg = "on Microsoft Access it is not possible to enumerate the hostname"
7878
logger.warn(warnMsg)
79+
80+
def getStatements(self):
81+
warnMsg = "on Microsoft Access it is not possible to enumerate the SQL statements"
82+
logger.warn(warnMsg)
83+
84+
return []

‎plugins/dbms/db2/enumeration.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,9 @@ def getPasswordHashes(self):
1414
logger.warn(warnMsg)
1515

1616
return {}
17+
18+
def getStatements(self):
19+
warnMsg = "on DB2 it is not possible to enumerate the SQL statements"
20+
logger.warn(warnMsg)
21+
22+
return []

‎plugins/dbms/firebird/enumeration.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,9 @@ def searchColumn(self):
3636
def getHostname(self):
3737
warnMsg = "on Firebird it is not possible to enumerate the hostname"
3838
logger.warn(warnMsg)
39+
40+
def getStatements(self):
41+
warnMsg = "on Firebird it is not possible to enumerate the SQL statements"
42+
logger.warn(warnMsg)
43+
44+
return []

0 commit comments

Comments
 (0)