| FazBrowse GitHub Viewer | Trending | | Home |
| Tools: [Download Repo ZIP] [Original HTTPS Page] |
… values to hardcoded statements (queries.xml)
|
nice. any way to test it here at my side? |
Sorry, something went wrong.
Here's an example Flask app using the Snowflake python connector: from flask import Flask, request
import snowflake.connector
conn = snowflake.connector.connect(
user="REDACTED",
password="REDACTED",
account="REDACTED",
warehouse="COMPUTE_WH",
database="SNOWFLAKE_SAMPLE_DATA",
schema="TPCDS_SF100TCL"
)
app = Flask(__name__)
@app.route("/shipping", methods=["GET"])
def hello():
shipping_id = request.args.get("id", "")
query = f"SELECT sm_ship_mode_id, sm_type, sm_carrier FROM ship_mode WHERE sm_ship_mode_id='{shipping_id}'"
try:
cursor = conn.cursor()
cursor.execute(query)
data = cursor.fetchall()
cursor.close()
except:
data = []
# blind
return {'status': len(data) > 0}
# union
return {
"count": len(data),
"results": [{"id": x[0], "type": x[1], "carrier": x[2]} for x in data]
}
if __name__ == "__main__":
app.run(host="127.0.0.1", port=5000)You can signup for a 30-day free trial: https://signup.snowflake.com/ Then you point and shoot: > $ sqlmap -u 'http://localhost:5000/shipping?id=AAAAAAAABAAAAAAA' -p id --threads 10 --dbs |
Sorry, something went wrong.
|
trying this PR this moment. lots of stuff is missing (e.g. auxiliary funcs in agent.py, like limitQuery, just ignore snowflake). also, this is py3 only compatible, while sqlmap is py2/py3 compatible. i'll try to sort this out tomorrow |
Sorry, something went wrong.
|
there is still tons of work to be done here :). i'll merge this and work on patches on HEAD/master. would you like me to put you into the THANKS.md? like with name and email? |
Sorry, something went wrong.
| Back | FazBrowse Home | New Git URL |
I've ran into the "Snowflake" DBMS when exploiting SQL injection often enough to warrant wanting SQLmap to do it auto-magically. This PR adds a plugin which adds support for the "Snowflake" DBMS.