sqlmapproject/sqlmap — pull request #475 by Meatballs1 (2013-06-24 14:16:29+00:00)
Title: HSQL Payloads and Query Support

An initial stab at implementing HSQL database support. I first cut my SQLi teeth on a HSQL implementation so it has a special place in my heart. I have added some example tomcat servlets in the testenv but these could use some more work to provide different tests. If anyone wants to provide some initial feedback that I can work on that would be great :)

I haven't scored the Payloads with LEVEL/RISK. Mostly I copied an example from the same section so RISK should be ok, but LEVEL may want to be increased for some.

Payloads include:
Stacked Queries (Time based blind)
AND Time based blind
OR Time based blind
Parameter replace time based blind (untested at present)
GROUP/ORDER BY Time based blind

GENERIC Union detection also works due to the dummy table configuration.

I don't think Error based is possible as java SQLExceptions don't seem to bring back any values, but generic Boolean error based works.

Later versions of HSQL > 2.0 are much more reliable - sometimes get null pointer exceptions from the database for some 1.7 calls but unable to determine why at present.

Notes:

The direct connector isn't functional.

I have issues with is_dba as the forgeCaseStatement doesn't work well with the dummy tables required by HSQL - it works fine with that statement commented out. I have come across this issue elsewhere but haven't made a note of all the times.

Time based blinds should work in 1.6 but no CASE statement is available so no straightforward way of retrieving data at present.

There should be potential for some file writing capabilities (potentially into webroots) I have achieved this previously by creating TEXTTABLES and writing JSP. In <=1.8 versions the writable path is controlled by a config file but this can be opened up as a TEXTTABLE, modified, server restarted, and then global writes allowed.

There is also potential to execute Java static methods, but mostly locked down to some libraries (e.g. Math) at present. May be interesting to do some further research to see if this can be bypassed to allow Java code exec.