Skip to content

Conversation

@GoonTools
Copy link
Contributor

I've ran into the "Snowflake" DBMS when exploiting SQL injection often enough to warrant wanting SQLmap to do it auto-magically. This PR adds a plugin which adds support for the "Snowflake" DBMS.

@stamparm
Copy link
Member

nice. any way to test it here at my side?

@GoonTools
Copy link
Contributor Author

nice. any way to test it here at my side?

Here's an example Flask app using the Snowflake python connector:

from flask import Flask, request
import snowflake.connector

conn = snowflake.connector.connect(
    user="REDACTED",
    password="REDACTED",
    account="REDACTED",
    warehouse="COMPUTE_WH",
    database="SNOWFLAKE_SAMPLE_DATA",
    schema="TPCDS_SF100TCL"
)

app = Flask(__name__)

@app.route("/shipping", methods=["GET"])
def hello():
    shipping_id = request.args.get("id", "")
    query = f"SELECT sm_ship_mode_id, sm_type, sm_carrier FROM ship_mode WHERE sm_ship_mode_id='{shipping_id}'"

    try:
        cursor = conn.cursor()
        cursor.execute(query)
        data = cursor.fetchall()
        cursor.close()
    except:
        data = []

    # blind
    return {'status': len(data) > 0}
    
    # union
    return {
        "count": len(data),
        "results": [{"id": x[0], "type": x[1], "carrier": x[2]} for x in data]
    }

if __name__ == "__main__":
    app.run(host="127.0.0.1", port=5000)

You can signup for a 30-day free trial: https://signup.snowflake.com/
Then you can grab connection details for the default SNOWFLAKE_SAMPLE_DATA database:
image

Then you point and shoot:

> $ sqlmap -u 'http://localhost:5000/shipping?id=AAAAAAAABAAAAAAA' -p id --threads 10 --dbs

@stamparm
Copy link
Member

stamparm commented Jan 11, 2026

trying this PR this moment. lots of stuff is missing (e.g. auxiliary funcs in agent.py, like limitQuery, just ignore snowflake). also, this is py3 only compatible, while sqlmap is py2/py3 compatible.

i'll try to sort this out tomorrow

@stamparm
Copy link
Member

there is still tons of work to be done here :). i'll merge this and work on patches on HEAD/master.

would you like me to put you into the THANKS.md? like with name and email?

@stamparm stamparm merged commit 279a9b3 into sqlmapproject:master Jan 12, 2026
stamparm added a commit that referenced this pull request Jan 12, 2026
stamparm added a commit that referenced this pull request Jan 12, 2026
@stamparm stamparm self-assigned this Jan 12, 2026
@stamparm stamparm added this to the 2.0 milestone Jan 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants