Skip to content

Firebird time-based payloads broken #362

Description

@bdamele

If possible, fix time-based vectors. Test case:

python sqlmap.py -u http://debiandev/sqlmap/firebird/get_int.php?id=1 -b --time-sec 2 --technique T --threads 4 -v 3 --risk 2 --level 4 --is-dba --parse-errors --flush-session
[...]
back-end DBMS: Firebird 2.0
[20:48:59] [INFO] fetching banner
[20:48:59] [PAYLOAD] 1 AND 4593=IIF((SUBSTRING((SELECT CAST(RDB$GET_CONTEXT(SYSTEM,ENGINE_VERSION) AS VARCHAR(10000)) FROM RDB$DATABASE) FROM 1 FOR 1) > @),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3),4593)
[20:48:59] [INFO] parsed error message: 'Dynamic SQL Error SQL error code = -104 Token unknown - line 1, column 162 @'
[20:48:59] [PAYLOAD] 1 AND 4593=IIF((SUBSTRING((SELECT CAST(RDB$GET_CONTEXT(SYSTEM,ENGINE_VERSION) AS VARCHAR(10000)) FROM RDB$DATABASE) FROM 1 FOR 1) >  ),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3),4593)
[20:48:59] [INFO] parsed error message: 'Dynamic SQL Error SQL error code = -104 Token unknown - line 1, column 163 )'
[20:48:59] [PAYLOAD] 1 AND 4593=IIF((SUBSTRING((SELECT CAST(RDB$GET_CONTEXT(SYSTEM,ENGINE_VERSION) AS VARCHAR(10000)) FROM RDB$DATABASE) FROM 1 FOR 1) > \x10),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3),4593)
[20:48:59] [INFO] parsed error message: 'Dynamic SQL Error SQL error code = -104 Token unknown - line 1, column 162 �'
[20:48:59] [PAYLOAD] 1 AND 4593=IIF((SUBSTRING((SELECT CAST(RDB$GET_CONTEXT(SYSTEM,ENGINE_VERSION) AS VARCHAR(10000)) FROM RDB$DATABASE) FROM 1 FOR 1) > \x07),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3),4593)
[20:48:59] [INFO] parsed error message: 'Dynamic SQL Error SQL error code = -104 Token unknown - line 1, column 162 '
[20:48:59] [PAYLOAD] 1 AND 4593=IIF((SUBSTRING((SELECT CAST(RDB$GET_CONTEXT(SYSTEM,ENGINE_VERSION) AS VARCHAR(10000)) FROM RDB$DATABASE) FROM 1 FOR 1) > \x03),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3),4593)
[20:48:59] [INFO] parsed error message: 'Dynamic SQL Error SQL error code = -104 Token unknown - line 1, column 162 �'
[20:48:59] [PAYLOAD] 1 AND 4593=IIF((SUBSTRING((SELECT CAST(RDB$GET_CONTEXT(SYSTEM,ENGINE_VERSION) AS VARCHAR(10000)) FROM RDB$DATABASE) FROM 1 FOR 1) > \x01),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3),4593)
[20:48:59] [INFO] parsed error message: 'Dynamic SQL Error SQL error code = -104 Token unknown - line 1, column 162 �'
[20:48:59] [INFO] retrieved: 
[20:48:59] [DEBUG] performed 6 queries in 0 seconds
[20:48:59] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' and/or switch '--hex'
banner: None
[20:48:59] [INFO] testing if current user is DBA
[20:48:59] [PAYLOAD] 1 AND 9183=IIF(((SELECT IIF(CURRENT_USER=SYSDBA,1,0) FROM RDB$DATABASE)=1),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3),9183)
[20:48:59] [INFO] parsed error message: 'Dynamic SQL Error SQL error code = -206 Column unknown SYSDBA At line 1, column 71'
current user is DBA:    False

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions