Skip to content

Conversation

@GoonTools
Copy link

I've ran into the "Snowflake" DBMS when exploiting SQL injection often enough to warrant wanting SQLmap to do it auto-magically. This PR adds a plugin which adds support for the "Snowflake" DBMS.

@stamparm
Copy link
Member

nice. any way to test it here at my side?

@GoonTools
Copy link
Author

nice. any way to test it here at my side?

Here's an example Flask app using the Snowflake python connector:

from flask import Flask, request
import snowflake.connector

conn = snowflake.connector.connect(
    user="REDACTED",
    password="REDACTED",
    account="REDACTED",
    warehouse="COMPUTE_WH",
    database="SNOWFLAKE_SAMPLE_DATA",
    schema="TPCDS_SF100TCL"
)

app = Flask(__name__)

@app.route("/shipping", methods=["GET"])
def hello():
    shipping_id = request.args.get("id", "")
    query = f"SELECT sm_ship_mode_id, sm_type, sm_carrier FROM ship_mode WHERE sm_ship_mode_id='{shipping_id}'"

    try:
        cursor = conn.cursor()
        cursor.execute(query)
        data = cursor.fetchall()
        cursor.close()
    except:
        data = []

    # blind
    return {'status': len(data) > 0}
    
    # union
    return {
        "count": len(data),
        "results": [{"id": x[0], "type": x[1], "carrier": x[2]} for x in data]
    }

if __name__ == "__main__":
    app.run(host="127.0.0.1", port=5000)

You can signup for a 30-day free trial: https://signup.snowflake.com/
Then you can grab connection details for the default SNOWFLAKE_SAMPLE_DATA database:
image

Then you point and shoot:

> $ sqlmap -u 'http://localhost:5000/shipping?id=AAAAAAAABAAAAAAA' -p id --threads 10 --dbs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants