FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Added "Snowflake" DBMS support by GoonTools · Pull Request #5980 · sqlmapproject/sqlmap · GitHub

Added "Snowflake" DBMS support - #5980

Merged
stamparm merged 6 commits into
sqlmapproject:masterfrom
GoonTools:master
Jan 12, 2026
Merged

Added "Snowflake" DBMS support#5980
stamparm merged 6 commits into
sqlmapproject:masterfrom
GoonTools:master

Conversation

Copy link
Copy Markdown
Contributor

I've ran into the "Snowflake" DBMS when exploiting SQL injection often enough to warrant wanting SQLmap to do it auto-magically. This PR adds a plugin which adds support for the "Snowflake" DBMS.

Copy link
Copy Markdown
Member

nice. any way to test it here at my side?

Copy link
Copy Markdown
Contributor Author

nice. any way to test it here at my side?

Here's an example Flask app using the Snowflake python connector:

from flask import Flask, request
import snowflake.connector

conn = snowflake.connector.connect(
    user="REDACTED",
    password="REDACTED",
    account="REDACTED",
    warehouse="COMPUTE_WH",
    database="SNOWFLAKE_SAMPLE_DATA",
    schema="TPCDS_SF100TCL"
)

app = Flask(__name__)

@app.route("/shipping", methods=["GET"])
def hello():
    shipping_id = request.args.get("id", "")
    query = f"SELECT sm_ship_mode_id, sm_type, sm_carrier FROM ship_mode WHERE sm_ship_mode_id='{shipping_id}'"

    try:
        cursor = conn.cursor()
        cursor.execute(query)
        data = cursor.fetchall()
        cursor.close()
    except:
        data = []

    # blind
    return {'status': len(data) > 0}
    
    # union
    return {
        "count": len(data),
        "results": [{"id": x[0], "type": x[1], "carrier": x[2]} for x in data]
    }

if __name__ == "__main__":
    app.run(host="127.0.0.1", port=5000)

You can signup for a 30-day free trial: https://signup.snowflake.com/
Then you can grab connection details for the default SNOWFLAKE_SAMPLE_DATA database:

Then you point and shoot:

> $ sqlmap -u 'http://localhost:5000/shipping?id=AAAAAAAABAAAAAAA' -p id --threads 10 --dbs

stamparm commented Jan 11, 2026
edited
Loading

Copy link
Copy Markdown
Member

trying this PR this moment. lots of stuff is missing (e.g. auxiliary funcs in agent.py, like limitQuery, just ignore snowflake). also, this is py3 only compatible, while sqlmap is py2/py3 compatible.

i'll try to sort this out tomorrow

Copy link
Copy Markdown
Member

there is still tons of work to be done here :). i'll merge this and work on patches on HEAD/master.

would you like me to put you into the THANKS.md? like with name and email?

stamparm merged commit 279a9b3 into sqlmapproject:master Jan 12, 2026
stamparm added a commit that referenced this pull request Jan 12, 2026
stamparm added a commit that referenced this pull request Jan 12, 2026
stamparm self-assigned this Jan 12, 2026
stamparm added this to the 2.0 milestone Jan 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants


Back | FazBrowse Home | New Git URL