@@ -171,107 +171,6 @@ def _thread():
171171
172172 return retVal
173173
174- def bedTest ():
175- """
176- Runs the testing against 'testbed'
177- """
178-
179- TESTS = (
180- # MaxDB
181- ("-u 'http://testbed/maxdb/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("Kernel____7.9.10___Build_003-123-265-343" , "Database: DBADMIN" , "Table: TESTUSERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "it looks like the back-end DBMS is 'SAP MaxDB'" , "the back-end DBMS is SAP MaxDB" , "current user is DBA: True" , ": 'foobar'" )),
182- ("-u 'http://testbed/maxdb/get_int.php?id=1' --flush-session --technique=U --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("Kernel____7.9.10___Build_003-123-265-343" , "Database: DBADMIN" , "Table: TESTUSERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is SAP MaxDB" , "appears to have 3 columns" , "current user is DBA: True" , ": 'foobar'" )),
183- ("-u 'http://testbed/maxdb/get_int.php?id=1' --flush-session --technique=U --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("Kernel____7.9.10___Build_003-123-265-343" , "current database (equivalent to owner on SAP MaxDB): 'SYS'" , "current user: 'DBADMIN'" , "[1 column]" , "| SURNAME | VARCHAR |" )),
184-
185- # Informix
186- ("-u 'http://testbed/informix/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("retrieved: 47" , "IBM Informix Dynamic Server Version 14.10.FC2DE" , "Database: testdb" , "Table: users" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "back-end DBMS could be 'Informix'" , "the back-end DBMS is Informix" , "current user is DBA: True" , ": 'foobar'" )),
187- ("-u 'http://testbed/informix/get_int.php?id=1' --flush-session --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("IBM Informix Dynamic Server Version 14.10.FC2DE" , "current database: 'testdb'" , "current user: 'testuser'" , "[1 column]" , "| surname | varchar |" )),
188-
189- # Altibase
190- ("-u 'http://testbed/altibase/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("x86_64-unknown-linux-gnu" , "Database: SYS" , "Table: TESTUSERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "back-end DBMS could be 'Altibase'" , "the back-end DBMS is Altibase" , "current user is DBA: True" , ": 'foobar'" )),
191- ("-u 'http://testbed/altibase/get_int.php?id=1' --flush-session --technique=U --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("x86_64-unknown-linux-gnu" , "Database: SYS" , "Table: TESTUSERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is Altibase" , "appears to have 3 columns" , "current user is DBA: True" , ": 'foobar'" )),
192- ("-u 'http://testbed/altibase/get_int.php?id=1' --flush-session --technique=U --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("x86_64-unknown-linux-gnu" , "current database (equivalent to owner on Altibase): 'SYS'" , "current user: 'SYS'" , "[1 column]" , "| SURNAME | VARCHAR |" )),
193-
194- # CockroachDB
195- ("-u 'http://testbed/cockroachdb/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("x86_64-unknown-linux-gnu" , "CockroachDB fork" , "Database: public" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "back-end DBMS could be 'PostgreSQL'" , "the back-end DBMS is PostgreSQL" , "current user is DBA: True" , ": 'foobar'" )),
196- ("-u 'http://testbed/cockroachdb/get_int.php?id=1' --flush-session --technique=U --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("x86_64-unknown-linux-gnu" , "CockroachDB fork" , "Database: public" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is PostgreSQL" , "appears to have 3 columns" , "current user is DBA: True" , ": 'foobar'" )),
197- ("-u 'http://testbed/cockroachdb/get_int.php?id=1' --flush-session --technique=E --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("x86_64-unknown-linux-gnu" , "CockroachDB fork" , "Database: public" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Title: PostgreSQL AND error-based" , "the back-end DBMS is PostgreSQL" , "current user is DBA: True" , ": 'foobar'" )),
198- ("-u 'http://testbed/cockroachdb/get_int.php?id=1' --flush-session --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("Title: AND boolean-based blind" , "Title: PostgreSQL AND error-based" , "Title: PostgreSQL > 8.1 stacked queries" , "Title: PostgreSQL > 8.1 AND time-based blind" , "Title: Generic UNION query (NULL) - 3 columns" , "x86_64-unknown-linux-gnu" , "current database (equivalent to schema on PostgreSQL): 'public'" , "current user: 'root'" , "[1 column]" , "| surname | varchar |" )),
199-
200- # CrateDB
201- ("-u 'http://testbed/cratedb/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("4.0.10" , "Database: doc" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "back-end DBMS could be 'CrateDB'" , "the back-end DBMS is CrateDB" , "current user is DBA: True" , ": 'foobar'" )),
202- ("-u 'http://testbed/cratedb/get_int.php?id=1' --flush-session --technique=B --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("4.0.10" , "current database (equivalent to schema on CrateDB): 'doc'" , "current user: 'crate'" , "[1 column]" , "| surname |" )),
203-
204- # Drizzle
205- ("-u 'http://testbed/drizzle/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("7.1.36-stable" , "Drizzle fork" , "Database: testdb" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "it looks like the back-end DBMS is 'MySQL'" , "the back-end DBMS is MySQL" , "current user is DBA: True" , ": 'foobar'" )),
206- ("-u 'http://testbed/drizzle/get_int.php?id=1' --flush-session --technique=U --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("7.1.36-stable" , "Drizzle fork" , "Database: testdb" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is MySQL" , "appears to have 3 columns" , "current user is DBA: True" , ": 'foobar'" )),
207- ("-u 'http://testbed/drizzle/get_int.php?id=1' --flush-session --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("Title: AND boolean-based blind" , "Title: MySQL >= 5.0.12 AND time-based blind" , "Title: Generic UNION query (NULL) - 3 columns" , "7.1.36-stable" , "current database: 'testdb'" , "current user: 'root'" , "[1 column]" , "| surname | VARCHAR |" )),
208-
209- # Firebird
210- ("-u 'http://testbed/firebird/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump --banner --sql-query=\" SELECT 'foobar'\" " , ("banner: '2.5" , "Table: USERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "possible DBMS: 'Firebird'" , "the back-end DBMS is Firebird" , "current user is DBA: True" , ": 'foobar'" )),
211- ("-u 'http://testbed/firebird/get_int.php?id=1' --flush-session --technique=U --is-dba --dump --banner --sql-query=\" SELECT 'foobar'\" " , ("banner: '2.5" , "Table: USERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is Firebird" , "appears to have 3 columns" , "current user is DBA: True" , ": 'foobar'" )),
212- ("-u 'http://testbed/firebird/get_int.php?id=1' --flush-session --technique=U --hex --banner --current-user --search -C surname --answers='dump=n'" , ("banner: '2.5" , "current user: 'SYSDBA'" , "[1 column]" , "| SURNAME | VARCHAR |" )),
213-
214- # H2
215- ("-u 'http://testbed/h2/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("1.4.192" , "Database: PUBLIC" , "Table: TESTUSERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "back-end DBMS could be 'H2'" , "the back-end DBMS is H2" , "current user is DBA: True" , ": 'foobar'" )),
216- ("-u 'http://testbed/h2/get_int.php?id=1' --flush-session --technique=U --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("1.4.192" , "Database: PUBLIC" , "Table: TESTUSERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is H2" , "appears to have 3 columns" , "current user is DBA: True" , ": 'foobar'" )),
217- ("-u 'http://testbed/h2/get_int.php?id=1' --flush-session --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("Title: AND boolean-based blind" , "Title: Generic inline queries" , "Title: Generic UNION query (NULL) - 3 columns" , "1.4.192" , "current database (equivalent to schema on H2): 'PUBLIC'" , "current user: 'SA'" , "[1 column]" , "| SURNAME | VARCHAR |" )),
218-
219- # HSQLDB
220- ("-u 'http://testbed/hsqldb/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("2.3.4" , "Database: PUBLIC" , "Table: TESTUSERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "it looks like the back-end DBMS is 'HSQLDB'" , "the back-end DBMS is HSQLDB" , "current user is DBA: True" , ": 'foobar'" )),
221- ("-u 'http://testbed/hsqldb/get_int.php?id=1' --flush-session --technique=U --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("2.3.4" , "Database: PUBLIC" , "Table: TESTUSERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is HSQLDB" , "appears to have 3 columns" , "current user is DBA: True" , ": 'foobar'" )),
222- ("-u 'http://testbed/hsqldb/get_int.php?id=1' --flush-session --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("Title: AND boolean-based blind" , "Title: HSQLDB > 2.0 AND time-based blind (heavy query)" , "Title: Generic UNION query (NULL) - 3 columns" , "2.3.4" , "current database (equivalent to schema on HSQLDB): 'PUBLIC'" , "current user: 'SA'" , "[1 column]" , "| SURNAME | VARCHAR |" )),
223-
224- # IBM DB2
225- ("-u 'http://testbed/db2/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("banner: 'DB2 v" , "Database: DB2INST1" , "Table: USERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "it looks like the back-end DBMS is 'IBM DB2'" , "the back-end DBMS is IBM DB2" , "current user is DBA: True" , ": 'foobar'" )),
226- ("-u 'http://testbed/db2/get_int.php?id=1' --flush-session --technique=U --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("banner: 'DB2 v" , "Database: DB2INST1" , "Table: USERS" , "5 entries" , "ID" , "NAME" , "SURNAME" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is IBM DB2" , "appears to have 3 columns" , "current user is DBA: True" , ": 'foobar'" )),
227- ("-u 'http://testbed/db2/get_int.php?id=1' --flush-session --technique=U --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("banner: 'DB2 v" , "current database (equivalent to owner on IBM DB2): 'DB2INST1'" , "current user: 'DB2INST1'" , "[1 column]" , "| SURNAME | VARCHAR(1000) |" )),
228-
229- # MariaDB
230- ("-u 'http://testbed/mariadb/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("10.4.12-MariaDB-1:10.4.12+maria~bionic" , "MariaDB fork" , "Database: testdb" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "it looks like the back-end DBMS is 'MySQL'" , "the back-end DBMS is MySQL" , "current user is DBA: True" , ": 'foobar'" )),
231- ("-u 'http://testbed/mariadb/get_int.php?id=1' --flush-session --technique=U --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("10.4.12-MariaDB-1:10.4.12+maria~bionic" , "MariaDB fork" , "Database: testdb" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is MySQL" , "appears to have 3 columns" , "current user is DBA: True" , ": 'foobar'" )),
232- ("-u 'http://testbed/mariadb/get_int.php?id=1' --flush-session --technique=E --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("10.4.12-MariaDB-1:10.4.12+maria~bionic" , "MariaDB fork" , "Database: testdb" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Title: MySQL >= 5.0 AND error-based" , "the back-end DBMS is MySQL" , "current user is DBA: True" , ": 'foobar'" )),
233- ("-u 'http://testbed/mariadb/get_int.php?id=1' --flush-session --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("Title: AND boolean-based blind" , "Title: MySQL >= 5.0 AND error-based" , "Title: MySQL >= 5.0.12 AND time-based blind" , "Title: Generic UNION query (NULL) - 3 columns" , "10.4.12-MariaDB-1:10.4.12+maria~bionic" , "current database: 'testdb'" , "current user: 'root@%'" , "[1 column]" , "| surname | varchar(1000) |" )),
234-
235- # MySQL
236- ("-u 'http://testbed/mysql/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("8.0.19" , "Database: testdb" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "it looks like the back-end DBMS is 'MySQL'" , "the back-end DBMS is MySQL" , "current user is DBA: True" , ": 'foobar'" )),
237- ("-u 'http://testbed/mysql/get_int.php?id=1' --flush-session --technique=U --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("8.0.19" , "Database: testdb" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is MySQL" , "appears to have 3 columns" , "current user is DBA: True" , ": 'foobar'" )),
238- ("-u 'http://testbed/mysql/get_int.php?id=1' --flush-session --technique=E --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("8.0.19" , "Database: testdb" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Title: MySQL >= 5.0 AND error-based" , "the back-end DBMS is MySQL" , "current user is DBA: True" , ": 'foobar'" )),
239- ("-u 'http://testbed/mysql/get_int.php?id=1' --flush-session --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("Title: AND boolean-based blind" , "Title: MySQL >= 5.1 AND error-based" , "Title: MySQL >= 5.0.12 AND time-based blind" , "Title: Generic UNION query (NULL) - 3 columns" , "8.0.19" , "current database: 'testdb'" , "current user: 'root@%'" , "[1 column]" , "| surname | varchar(1000) |" )),
240-
241- # PostgreSQL
242- ("-u 'http://testbed/postgresql/get_int.php?id=1' --flush-session --technique=B --is-dba --threads=4 --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("x86_64-pc-linux-gnu" , "Database: public" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Payload: id=1 AND " , "it looks like the back-end DBMS is 'PostgreSQL'" , "the back-end DBMS is PostgreSQL" , "current user is DBA: False" , ": 'foobar'" )),
243- ("-u 'http://testbed/postgresql/get_int.php?id=1' --flush-session --technique=U --is-dba --dump -D CD --banner --sql-query=\" SELECT 'foobar'\" " , ("x86_64-pc-linux-gnu" , "Database: public" , "Table: testusers" , "5 entries" , "id" , "name" , "surname" , "luther" , "blisset" , "NULL" , "Title: Generic UNION query (NULL) - 3 columns" , "the back-end DBMS is PostgreSQL" , "appears to have 3 columns" , "current user is DBA: False" , ": 'foobar'" )),
244- ("-u 'http://testbed/postgresql/get_int.php?id=1' --flush-session --hex --banner --current-user --current-db --search -C surname --answers='dump=n'" , ("Title: AND boolean-based blind" , "Title: PostgreSQL AND error-based" , "Title: PostgreSQL > 8.1 stacked queries" , "Title: PostgreSQL > 8.1 AND time-based blind" , "Title: Generic UNION query (NULL) - 3 columns" , "x86_64-pc-linux-gnu" , "current database (equivalent to schema on PostgreSQL): 'public'" , "current user: 'testuser'" , "[1 column]" , "| surname | varchar |" )),
245- )
246-
247- retVal = True
248- count = 0
249-
250- for options , checks in TESTS :
251- status = '%d/%d (%d%%) ' % (count , len (TESTS ), round (100.0 * count / len (TESTS )))
252- dataToStdout ("\r [%s] [INFO] complete: %s" % (time .strftime ("%X" ), status ))
253-
254- cmd = "%s %s %s --batch" % (sys .executable , os .path .abspath (os .path .join (os .path .dirname (__file__ ), ".." , ".." , "sqlmap.py" )), options )
255- output = shellExec (cmd )
256-
257- if not all ((check in output if not check .startswith ('~' ) else check [1 :] not in output ) for check in checks ):
258- for check in checks :
259- if check not in output :
260- print (cmd , check )
261- dataToStdout ("---\n \n $ %s\n " % cmd )
262- dataToStdout ("%s---\n " % output , coloring = False )
263- retVal = False
264-
265- count += 1
266-
267- clearConsoleLine ()
268- if retVal :
269- logger .info ("bed test final result: PASSED" )
270- else :
271- logger .error ("best test final result: FAILED" )
272-
273- return retVal
274-
275174def fuzzTest ():
276175 count = 0
277176 address , port = "127.0.0.10" , random .randint (1025 , 65535 )
0 commit comments