[pull] master from sqlmapproject:master

lib/core/settings.py

@@ -20,7 +20,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.8.33"
+VERSION = "1.10.8.35"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

tamper/between.py

@@ -19,16 +19,18 @@ def tamper(payload, **kwargs):
     Replaces the greater-than operator (>) with NOT BETWEEN 0 AND # and the equal sign (=) with BETWEEN # AND #
 
     Tested against:
-        * Microsoft SQL Server 2005
-        * MySQL 4, 5.0 and 5.5
-        * Oracle 10g
-        * PostgreSQL 8.3, 8.4, 9.0
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * SQLite 3.45.1
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
 
     Notes:
         * Useful to bypass weak and bespoke web application firewalls that
           filter the greater than character
-        * The BETWEEN clause is SQL standard. Hence, this tamper script
-          should work against all (?) databases
+        * The BETWEEN clause is SQL standard, and the rewrite was confirmed
+          to run unchanged on every engine listed above
 
     >>> tamper('1 AND A > B--')
     '1 AND A NOT BETWEEN 0 AND B--'

tamper/commalesslimit.py

@@ -23,9 +23,19 @@ def tamper(payload, **kwargs):
 
     Requirement:
         * MySQL
+        * MariaDB
+        * SQLite
 
     Tested against:
-        * MySQL 5.0 and 5.5
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * SQLite 3.45.1
+
+    Notes:
+        * Applicability is set by the 'LIMIT M, N' input form, which only MySQL,
+          MariaDB and SQLite accept. PostgreSQL rejects it (it takes solely the
+          'LIMIT N OFFSET M' form this script produces), so the script never has
+          anything to rewrite there
 
     >>> tamper('LIMIT 2, 3')
     'LIMIT 3 OFFSET 2'

tamper/commentbeforeparentheses.py

@@ -19,10 +19,12 @@ def tamper(payload, **kwargs):
     Prepends (inline) comment before parentheses (e.g. ( -> /**/()
 
     Tested against:
-        * Microsoft SQL Server
-        * MySQL
-        * Oracle
-        * PostgreSQL
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * SQLite 3.45.1
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
 
     Notes:
         * Useful to bypass web application firewalls that block usage

tamper/equaltolike.py

@@ -18,15 +18,27 @@ def tamper(payload, **kwargs):
     """
     Replaces all occurrences of operator equal ('=') with 'LIKE' counterpart
 
+    Requirement:
+        * MySQL
+        * MariaDB
+        * SQLite
+        * Microsoft SQL Server
+        * Oracle
+
     Tested against:
-        * Microsoft SQL Server 2005
-        * MySQL 4, 5.0 and 5.5
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * SQLite 3.45.1
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
 
     Notes:
         * Useful to bypass weak and bespoke web application firewalls that
           filter the equal character ('=')
-        * The LIKE operator is SQL standard. Hence, this tamper script
-          should work against all (?) databases
+        * NOT usable against PostgreSQL, which refuses to compare a numeric
+          operand with LIKE (e.g. '1 LIKE 1' raises 'operator does not exist:
+          integer ~~ integer'), unlike the engines listed above which coerce
+          the operands to text
 
     >>> tamper('SELECT * FROM users WHERE id=1')
     'SELECT * FROM users WHERE id LIKE 1'

tamper/greatest.py

@@ -18,16 +18,26 @@ def tamper(payload, **kwargs):
     """
     Replaces greater than operator ('>') with 'GREATEST' counterpart
 
+    Requirement:
+        * MySQL
+        * MariaDB
+        * PostgreSQL
+        * Microsoft SQL Server >= 2022
+        * Oracle
+
     Tested against:
-        * MySQL 4, 5.0 and 5.5
-        * Oracle 10g
-        * PostgreSQL 8.3, 8.4, 9.0
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
 
     Notes:
         * Useful to bypass weak and bespoke web application firewalls that
           filter the greater than character
-        * The GREATEST clause is a widespread SQL command. Hence, this
-          tamper script should work against majority of databases
+        * NOT usable against SQLite, which has no GREATEST() (it overloads
+          MAX() for the multi-argument case instead). Microsoft SQL Server
+          only gained GREATEST() in 2022
 
     >>> tamper('1 AND A > B')
     '1 AND GREATEST(A,B+1)=A'

tamper/if2case.py

@@ -48,15 +48,18 @@ def tamper(payload, **kwargs):
 
     Requirement:
         * MySQL
-        * SQLite (possibly)
-        * SAP MaxDB (possibly)
+        * MariaDB
 
     Tested against:
-        * MySQL 5.0 and 5.5
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
 
     Notes:
         * Useful to bypass very weak and bespoke web application firewalls
           that filter the IF() functions
+        * The CASE replacement itself is standard SQL and runs anywhere, but the
+          'IF(A, B, C)' input form is MySQL/MariaDB-only (SQLite, for one, has no
+          IF() function), so there is nothing to rewrite on other engines
 
     >>> tamper('IF(1, 2, 3)')
     'CASE WHEN (1) THEN (2) ELSE (3) END'

tamper/ifnull2casewhenisnull.py

@@ -19,15 +19,17 @@ def tamper(payload, **kwargs):
 
     Requirement:
         * MySQL
-        * SQLite (possibly)
-        * SAP MaxDB (possibly)
+        * MariaDB
 
     Tested against:
-        * MySQL 5.0 and 5.5
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
 
     Notes:
         * Useful to bypass very weak and bespoke web application firewalls
           that filter the IFNULL() functions
+        * NOT usable against SQLite, despite it having IFNULL(): the replacement
+          needs ISNULL(), which SQLite does not provide
 
     >>> tamper('IFNULL(1, 2)')
     'CASE WHEN ISNULL(1) THEN (2) ELSE (1) END'

tamper/ifnull2ifisnull.py

@@ -19,15 +19,17 @@ def tamper(payload, **kwargs):
 
     Requirement:
         * MySQL
-        * SQLite (possibly)
-        * SAP MaxDB (possibly)
+        * MariaDB
 
     Tested against:
-        * MySQL 5.0 and 5.5
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
 
     Notes:
         * Useful to bypass very weak and bespoke web application firewalls
           that filter the IFNULL() function
+        * NOT usable against SQLite, despite it having IFNULL(): the replacement
+          needs both IF() and ISNULL(), neither of which SQLite provides
 
     >>> tamper('IFNULL(1, 2)')
     'IF(ISNULL(1),2,1)'

tamper/least.py

@@ -18,16 +18,26 @@ def tamper(payload, **kwargs):
     """
     Replaces greater than operator ('>') with 'LEAST' counterpart
 
+    Requirement:
+        * MySQL
+        * MariaDB
+        * PostgreSQL
+        * Microsoft SQL Server >= 2022
+        * Oracle
+
     Tested against:
-        * MySQL 4, 5.0 and 5.5
-        * Oracle 10g
-        * PostgreSQL 8.3, 8.4, 9.0
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
 
     Notes:
         * Useful to bypass weak and bespoke web application firewalls that
           filter the greater than character
-        * The LEAST clause is a widespread SQL command. Hence, this
-          tamper script should work against majority of databases
+        * NOT usable against SQLite, which has no LEAST() (it overloads
+          MIN() for the multi-argument case instead). Microsoft SQL Server
+          only gained LEAST() in 2022
 
     >>> tamper('1 AND A > B')
     '1 AND LEAST(A,B+1)=B+1'

tamper/lowercase.py

@@ -20,10 +20,12 @@ def tamper(payload, **kwargs):
     Replaces each keyword character with lower case value (e.g. SELECT -> select)
 
     Tested against:
-        * Microsoft SQL Server 2005
-        * MySQL 4, 5.0 and 5.5
-        * Oracle 10g
-        * PostgreSQL 8.3, 8.4, 9.0
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * SQLite 3.45.1
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
 
     Notes:
         * Useful to bypass very weak and bespoke web application firewalls

tamper/multiplespaces.py

@@ -21,6 +21,14 @@ def tamper(payload, **kwargs):
     """
     Adds multiple spaces (' ') around SQL keywords
 
+    Tested against:
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * SQLite 3.45.1
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
+
     Notes:
         * Useful to bypass very weak and bespoke web application firewalls
           that has poorly written permissive regular expressions

tamper/randomcase.py

@@ -22,16 +22,17 @@ def tamper(payload, **kwargs):
     Replaces each keyword character with random case value (e.g. SELECT -> SEleCt)
 
     Tested against:
-        * Microsoft SQL Server 2005
-        * MySQL 4, 5.0 and 5.5
-        * Oracle 10g
-        * PostgreSQL 8.3, 8.4, 9.0
-        * SQLite 3
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * SQLite 3.45.1
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
 
     Notes:
         * Useful to bypass very weak and bespoke web application firewalls
           that has poorly written permissive regular expressions
-        * This tamper script should work against all (?) databases
+        * Keyword case is insignificant on every engine listed above
 
     >>> import random
     >>> random.seed(0)

tamper/sign.py

@@ -19,10 +19,12 @@ def tamper(payload, **kwargs):
     Replaces greater than operator ('>') with 'SIGN' counterpart (e.g. SIGN((A)-(B))=1)
 
     Tested against:
-        * MySQL 5
-        * Oracle 11g
-        * PostgreSQL 9
-        * Microsoft SQL Server 2012
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * SQLite 3.45.1
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
 
     Notes:
         * Useful to bypass filtering of comparison operators altogether (>, <,

tamper/space2comment.py

@@ -18,10 +18,12 @@ def tamper(payload, **kwargs):
     Replaces space character (' ') with comments '/**/'
 
     Tested against:
-        * Microsoft SQL Server 2005
-        * MySQL 4, 5.0 and 5.5
-        * Oracle 10g
-        * PostgreSQL 8.3, 8.4, 9.0
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * SQLite 3.45.1
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
 
     Notes:
         * Useful to bypass weak and bespoke web application firewalls

tamper/space2morecomment.py

@@ -18,10 +18,17 @@ def tamper(payload, **kwargs):
     Replaces (MySQL) instances of space character (' ') with comments '/**_**/'
 
     Tested against:
-        * MySQL 5.0 and 5.5
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * SQLite 3.45.1
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
 
     Notes:
         * Useful to bypass weak and bespoke web application firewalls
+        * Despite the script's name, '/**_**/' is a valid comment on every engine
+          listed above, not just MySQL
 
     >>> tamper('SELECT id FROM users')
     'SELECT/**_**/id/**_**/FROM/**_**/users'

tamper/unionalltounion.py

@@ -18,6 +18,14 @@ def tamper(payload, **kwargs):
     """
     Replaces instances of UNION ALL SELECT with UNION SELECT counterpart
 
+    Tested against:
+        * MySQL 8.4.9
+        * MariaDB 11.8.8
+        * PostgreSQL 16.11
+        * SQLite 3.45.1
+        * Microsoft SQL Server 2022
+        * Oracle 23ai
+
     >>> tamper('-1 UNION ALL SELECT')
     '-1 UNION SELECT'
     """