mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-08-04 14:55:40 +00:00
112 lines
4.5 KiB
Markdown
112 lines
4.5 KiB
Markdown
# boundarycheck
|
|
|
|
A live cross-DBMS validator for `data/xml/boundaries.xml`. For every reachable DBMS it builds the
|
|
**real** injected value for each boundary (through sqlmap's own `agent.prefixQuery` / `suffixQuery` /
|
|
`cleanupPayload`, not a re-implementation) across representative host-query contexts, runs it against
|
|
the engine, and classifies each boundary via three oracles:
|
|
|
|
```
|
|
W boolean TRUE/FALSE variants are valid AND their row counts differ
|
|
T time an inline conditional sleep delays on TRUE, not on FALSE (MySQL / PostgreSQL)
|
|
I inband an injected marker surfaces in the result set (table cross-join / UNION)
|
|
. inert valid SQL but no channel discriminated in the contexts tried
|
|
x invalid a syntax / semantic error on this engine
|
|
```
|
|
|
|
It prints a `boundary x engine` matrix plus the boundaries usable via **no** oracle on any engine
|
|
(the "no working context found" review candidates). Any engine that does not connect is **skipped**
|
|
and reported as such — never silently counted as covered.
|
|
|
|
> Scope: covers boolean + inline-time (MySQL/PG) + inband over a sampled set of contexts. It does
|
|
> **not** model an error-based oracle, inline time on MSSQL/Oracle (statement/privilege-gated sleep),
|
|
> or every possible host context. So a boundary flagged "usable via no oracle" may still work via one
|
|
> of those — confirm before acting.
|
|
|
|
---
|
|
|
|
## Quick start (throwaway MySQL + PostgreSQL)
|
|
|
|
```bash
|
|
pip install pymysql psycopg2-binary # python drivers (see below for MSSQL/Oracle)
|
|
./run.sh # spins up 2 containers, runs, tears everything down
|
|
```
|
|
|
|
`run.sh` is fully disposable: it creates two containers, waits for readiness, runs the tool, and
|
|
removes them again on exit (including Ctrl-C / failure). Nothing persists.
|
|
|
|
---
|
|
|
|
## Full lab (all four engines) — step by step
|
|
|
|
The tool's built-in default endpoints (override any via env var — see below):
|
|
|
|
| engine | host:port | user / pass | db / service |
|
|
|------------|-------------------|----------------------|--------------|
|
|
| MySQL | `127.0.0.1:13306` | `root` / `root` | — |
|
|
| PostgreSQL | `127.0.0.1:15432` | `esp` / `pass` | `espdb` |
|
|
| MSSQL | `127.0.0.1:11433` | `sa` / `Esp_pass123` | — |
|
|
| Oracle | `127.0.0.1:1521` | `system` / `oracle` | `FREEPDB1` |
|
|
|
|
### 1. Python drivers
|
|
|
|
```bash
|
|
pip install pymysql psycopg2-binary pymssql oracledb
|
|
```
|
|
|
|
(Install only the ones you need — a missing driver just skips that engine.)
|
|
|
|
### 2. Start the containers
|
|
|
|
```bash
|
|
# MySQL (fast)
|
|
docker run -d --rm --name bcheck-mysql -e MYSQL_ROOT_PASSWORD=root -p 13306:3306 mysql:8.4
|
|
|
|
# PostgreSQL (fast)
|
|
docker run -d --rm --name bcheck-pg -e POSTGRES_USER=esp -e POSTGRES_PASSWORD=pass -e POSTGRES_DB=espdb -p 15432:5432 postgres:16
|
|
|
|
# MSSQL (slower; ~30-60s to accept connections)
|
|
docker run -d --rm --name bcheck-mssql -e ACCEPT_EULA=Y -e MSSQL_SA_PASSWORD=Esp_pass123 -p 11433:1433 mcr.microsoft.com/mssql/server:2022-latest
|
|
|
|
# Oracle Free (slowest; first boot can take a few minutes and the image is large)
|
|
docker run -d --rm --name bcheck-oracle -e ORACLE_PASSWORD=oracle -p 1521:1521 gvenzl/oracle-free:slim
|
|
```
|
|
|
|
Give MSSQL/Oracle time to finish initialising before running the tool (watch `docker logs -f <name>`).
|
|
|
|
### 3. Run
|
|
|
|
```bash
|
|
python3 boundarycheck.py # from anywhere; it locates the sqlmap root itself
|
|
```
|
|
|
|
### 4. Override an endpoint (optional)
|
|
|
|
```
|
|
BC_MYSQL=host:port:user:pass
|
|
BC_POSTGRES=host:port:user:pass:db
|
|
BC_MSSQL=host:port:user:pass
|
|
BC_ORACLE=host:port:user:pass:service # service_name goes in the db slot
|
|
```
|
|
|
|
```bash
|
|
BC_MYSQL=10.0.0.5:3306:root:secret python3 boundarycheck.py
|
|
```
|
|
|
|
### 5. Tear down
|
|
|
|
```bash
|
|
docker rm -f bcheck-mysql bcheck-pg bcheck-mssql bcheck-oracle
|
|
```
|
|
|
|
---
|
|
|
|
## Notes
|
|
|
|
- **Faithfulness:** the tool imports the `plugins.dbms.*` packages so each DBMS's `unescaper` is
|
|
registered. Without that, `SELECT '[RANDSTR]'` renders as a bare identifier instead of the real
|
|
`0x`-hex / `CHR()` literal and concat-style boundaries are mis-reported. A `_faithful_or_die()`
|
|
self-check aborts if the registration ever fails to load.
|
|
- **Side-effect-free on the target data:** it creates a scratch table `bc` (and a `boundarycheck`
|
|
database on MySQL), and drops them on completion. DML boundaries write only to a spare `note` column.
|
|
- Engines are used purely as SQL oracles over localhost throwaway containers — do not point the
|
|
override env vars at anything you care about.
|