Research Prototype
This project should at this stage still be seen as a research prototype. We believe that the tool is not ready to be used. However, we have received many requests by companies, organizations, and individual developers, which is why we decided to prematurely release the tool. Expect errors, incompatibilities, lack of documentation, and insufficient code quality. That being said, we are working hard to address these issues and enhance SQLancer to become a production-quality piece of software. We welcome any issue reports, extension requests, and code contributions.
Testing Approaches
Approach Description Pivoted Query Synthesis (PQS) PQS is the first technique that we designed and implemented. It randomly selects a row, called a pivot row, for which a query is generated that is guaranteed to fetch the row. If the row is not contained in the result set, a bug has been detected. It is fully described here (https://arxiv.org/abs/2001.04174). PQS is the most powerful technique, but also requires more implementation effort than the other two techniques. It is currently unmaintained. Non-optimizing Reference Engine Construction (NoREC) NoREC aims to find optimization bugs. It is described here (https://www.manuelrigger.at/preprints/NoREC.pdf). It translates a query that is potentially optimized by the DBMS to one for which hardly any optimizations are applicable, and compares the two result sets. A mismatch between the result sets indicates a bug in the DBMS. Ternary Logic Partitioning (TLP) TLP partitions a query into three partitioning queries, whose results are composed and compare to the original query's result set. A mismatch in the result sets indicates a bug in the DBMS. In contrast to NoREC and PQS, it can detect bugs in advanced features such as aggregate functions. Please find the .bib entries here (https://github.com/sqlancer/sqlancer/blob/master/docs/PAPERS.md).
Supported DBMS
Since SQL dialects differ widely, each DBMS to be tested requires a separate implementation. DBMS Status Expression Generation Description SQLite Working Untyped This implementation is currently affected by a significant performance (https://www.kitploit.com/search/label/Performance) regression that still needs to be investigated MySQL Working Untyped Running this implementation likely uncovers additional, unreported bugs. PostgreSQL Working Typed Citus (PostgreSQL Extension) Working Typed This implementation extends the PostgreSQL (https://www.kitploit.com/search/label/PostgreSQL) implementation of SQLancer, and was contributed by the Citus team. MariaDB Preliminary Untyped The implementation of this DBMS is very preliminary, since we stopped extending it after all but one of our bug reports were addressed. Running it likely uncovers additional, unreported bugs. CockroachDB Working Typed TiDB Working Untyped DuckDB Working Untyped, Generic ClickHouse Preliminary Untyped, Generic Implementing the different table engines was not convenient, which is why only a very preliminary implementation exists. TDEngine Removed Untyped We removed the TDEngine implementation since all but one of our bug reports were still unaddressed five months after we reported them.
Using SQLancer
Logs
SQLancer stores logs in the target/logs subdirectory. By default, the option --log-each-select is enabled, which results in every SQL statement that is sent to the DBMS being logged. The corresponding file names are postfixed with -cur.log. In addition, if SQLancer detects a logic bug, it creates a file with the extension .log, in which the statements to reproduce the bug are logged.
Reducing a Bug
This project should at this stage still be seen as a research prototype. We believe that the tool is not ready to be used. However, we have received many requests by companies, organizations, and individual developers, which is why we decided to prematurely release the tool. Expect errors, incompatibilities, lack of documentation, and insufficient code quality. That being said, we are working hard to address these issues and enhance SQLancer to become a production-quality piece of software. We welcome any issue reports, extension requests, and code contributions.
Testing Approaches
Approach Description Pivoted Query Synthesis (PQS) PQS is the first technique that we designed and implemented. It randomly selects a row, called a pivot row, for which a query is generated that is guaranteed to fetch the row. If the row is not contained in the result set, a bug has been detected. It is fully described here (https://arxiv.org/abs/2001.04174). PQS is the most powerful technique, but also requires more implementation effort than the other two techniques. It is currently unmaintained. Non-optimizing Reference Engine Construction (NoREC) NoREC aims to find optimization bugs. It is described here (https://www.manuelrigger.at/preprints/NoREC.pdf). It translates a query that is potentially optimized by the DBMS to one for which hardly any optimizations are applicable, and compares the two result sets. A mismatch between the result sets indicates a bug in the DBMS. Ternary Logic Partitioning (TLP) TLP partitions a query into three partitioning queries, whose results are composed and compare to the original query's result set. A mismatch in the result sets indicates a bug in the DBMS. In contrast to NoREC and PQS, it can detect bugs in advanced features such as aggregate functions. Please find the .bib entries here (https://github.com/sqlancer/sqlancer/blob/master/docs/PAPERS.md).
Supported DBMS
Since SQL dialects differ widely, each DBMS to be tested requires a separate implementation. DBMS Status Expression Generation Description SQLite Working Untyped This implementation is currently affected by a significant performance (https://www.kitploit.com/search/label/Performance) regression that still needs to be investigated MySQL Working Untyped Running this implementation likely uncovers additional, unreported bugs. PostgreSQL Working Typed Citus (PostgreSQL Extension) Working Typed This implementation extends the PostgreSQL (https://www.kitploit.com/search/label/PostgreSQL) implementation of SQLancer, and was contributed by the Citus team. MariaDB Preliminary Untyped The implementation of this DBMS is very preliminary, since we stopped extending it after all but one of our bug reports were addressed. Running it likely uncovers additional, unreported bugs. CockroachDB Working Typed TiDB Working Untyped DuckDB Working Untyped, Generic ClickHouse Preliminary Untyped, Generic Implementing the different table engines was not convenient, which is why only a very preliminary implementation exists. TDEngine Removed Untyped We removed the TDEngine implementation since all but one of our bug reports were still unaddressed five months after we reported them.
Using SQLancer
Logs
SQLancer stores logs in the target/logs subdirectory. By default, the option --log-each-select is enabled, which results in every SQL statement that is sent to the DBMS being logged. The corresponding file names are postfixed with -cur.log. In addition, if SQLancer detects a logic bug, it creates a file with the extension .log, in which the statements to reproduce the bug are logged.
Reducing a Bug
After finding a bug, it is useful to produce a minimal test case before reporting the bug, to save the DBMS developers' time and effort. For many test cases, C-Reduce (https://embed.cs.utah.edu/creduce/) does a great job. In addition, we have been working on a SQL-specific reducer, which we plan to release soon.
Found Bugs
We would appreciate it if you mention SQLancer when you report bugs found by it. We would also be excited to know if you are using SQLancer to find bugs, or if you have extended it to test another DBMS (also if you do not plan to contribute it to this project). SQLancer has found over 400 bugs in widely-used DBMS, which are listed here (https://www.manuelrigger.at/dbms-bugs/).
Community
We have created a Slack workspace (https://join.slack.com/t/sqlancer/shared_invite/zt-eozrcao4-ieG29w1LNaBDMF7OB_~ACg) to discuss SQLancer, and DBMS testing in general. SQLancer's official Twitter handle is @sqlancer_dbms (https://twitter.com/sqlancer_dbms).
Additional Documentation
Contributing to SQLancer (https://github.com/sqlancer/sqlancer/blob/master/CONTRIBUTING.md) Papers and .bib entries (https://github.com/sqlancer/sqlancer/blob/master/docs/PAPERS.md)
Releases
Official release are available on: GitHub (https://github.com/sqlancer/sqlancer/releases) Maven Central (https://search.maven.org/artifact/com.sqlancer/sqlancer) DockerHub (https://hub.docker.com/r/mrigger/sqlancer)
Additional Resources
A talk on Ternary Logic Partitioning (TLP) and SQLancer is available on YouTube (https://www.youtube.com/watch?v=Np46NQ6lqP8). An (older) Pivoted Query Synthesis (PQS) talk is available on YouTube (https://www.youtube.com/watch?v=yzENTaWe7qg). PingCAP has implemented PQS, NoREC, and TLP in a tool called go-sqlancer (https://github.com/chaos-mesh/go-sqlancer). More information on our DBMS testing efforts and the bugs we found is available here (https://www.manuelrigger.at/dbms-bugs/).
Download Sqlancer (https://github.com/sqlancer/sqlancer)
Found Bugs
We would appreciate it if you mention SQLancer when you report bugs found by it. We would also be excited to know if you are using SQLancer to find bugs, or if you have extended it to test another DBMS (also if you do not plan to contribute it to this project). SQLancer has found over 400 bugs in widely-used DBMS, which are listed here (https://www.manuelrigger.at/dbms-bugs/).
Community
We have created a Slack workspace (https://join.slack.com/t/sqlancer/shared_invite/zt-eozrcao4-ieG29w1LNaBDMF7OB_~ACg) to discuss SQLancer, and DBMS testing in general. SQLancer's official Twitter handle is @sqlancer_dbms (https://twitter.com/sqlancer_dbms).
Additional Documentation
Contributing to SQLancer (https://github.com/sqlancer/sqlancer/blob/master/CONTRIBUTING.md) Papers and .bib entries (https://github.com/sqlancer/sqlancer/blob/master/docs/PAPERS.md)
Releases
Official release are available on: GitHub (https://github.com/sqlancer/sqlancer/releases) Maven Central (https://search.maven.org/artifact/com.sqlancer/sqlancer) DockerHub (https://hub.docker.com/r/mrigger/sqlancer)
Additional Resources
A talk on Ternary Logic Partitioning (TLP) and SQLancer is available on YouTube (https://www.youtube.com/watch?v=Np46NQ6lqP8). An (older) Pivoted Query Synthesis (PQS) talk is available on YouTube (https://www.youtube.com/watch?v=yzENTaWe7qg). PingCAP has implemented PQS, NoREC, and TLP in a tool called go-sqlancer (https://github.com/chaos-mesh/go-sqlancer). More information on our DBMS testing efforts and the bugs we found is available here (https://www.manuelrigger.at/dbms-bugs/).
Download Sqlancer (https://github.com/sqlancer/sqlancer)
Story Of Unexpected Bugs
Hello, amazing hackers, My name is Neh Patel and I’m a bug hunter.Continue reading on Medium »
Read more...
Hello, amazing hackers, My name is Neh Patel and I’m a bug hunter.Continue reading on Medium »
Read more...
Hello, amazing hackers, My name is Neh Patel and I’m a bug hunter.Continue reading on Medium » (https://medium.com/@nehpatel/story-of-unexpected-bugs-75734d51ac57?source=rss------bug_bounty-5)
hacking: security in practice
Why ajax spider failed to start/connect to my firefox esr with owasp zap?
When I attack https://testphp.vulnweb.com with ajax spider it leave a error message saying "Failed to start/connect to 'Firefox Headless,' is the browser available/supported?" I'm not sure how to fix it. I did delete it but install it again. Not working.
submitted by /u/BlackAndroid18
[link] [comments]
Why ajax spider failed to start/connect to my firefox esr with owasp zap?
When I attack https://testphp.vulnweb.com with ajax spider it leave a error message saying "Failed to start/connect to 'Firefox Headless,' is the browser available/supported?" I'm not sure how to fix it. I did delete it but install it again. Not working.
submitted by /u/BlackAndroid18
[link] [comments]
reddit
Why ajax spider failed to start/connect to my firefox esr with...
When I attack https://testphp.vulnweb.com with ajax spider it leave a error message saying "Failed to start/connect to 'Firefox Headless,' is the...
hacking: security in practice
i think i’ve been hacked!!
idk if what i’m about to say sounds really dumb or silly but i downloaded a shady file and ran it (cmd) then nothing happened. then windows defender was gone so i installed a fresh windows setup but 2 hours ago i got a notification on fb that i had created a page and uploaded a video (it was some ad and the page was called misty view and the ad was about a bank or smth) as soon as i saw that i deleted the page and also found out that i just removed someone from my acc!! then i changed all my passwords and set up 2factor authentication but im really worried idk anything about these stuff so what am i supposed to do now??
submitted by /u/xochipilli07
[link] [comments]
i think i’ve been hacked!!
idk if what i’m about to say sounds really dumb or silly but i downloaded a shady file and ran it (cmd) then nothing happened. then windows defender was gone so i installed a fresh windows setup but 2 hours ago i got a notification on fb that i had created a page and uploaded a video (it was some ad and the page was called misty view and the ad was about a bank or smth) as soon as i saw that i deleted the page and also found out that i just removed someone from my acc!! then i changed all my passwords and set up 2factor authentication but im really worried idk anything about these stuff so what am i supposed to do now??
submitted by /u/xochipilli07
[link] [comments]
reddit
i think i’ve been hacked!!
idk if i’m about to say sounds really dumb or silly but i downloaded a shady file and ran it (cmd) then nothing happened. then windows defender...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
NMAP Kullanım Rehberi
Merhabalar, bu yazımda sizlere nmap kullanımından bahsedeceğim. Nmap’te hangi komutlar kullanılıyor ve ne işe yarıyor bunları…
Continue reading on Medium »
NMAP Kullanım Rehberi
Merhabalar, bu yazımda sizlere nmap kullanımından bahsedeceğim. Nmap’te hangi komutlar kullanılıyor ve ne işe yarıyor bunları…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
El ser humano como sistema complejo
https://cdn-images-1.medium.com/max/1320/1*8YhyC2MTPmvNRhHCSiVEtQ.jpeg
El 27 de mayo de 2005 llegó por primera vez a Argentina, al menos de manera pública, el famoso hacker Kevin Mitnick, ya reconvertido en…
Continue reading on Ingeniería Social »
El ser humano como sistema complejo
https://cdn-images-1.medium.com/max/1320/1*8YhyC2MTPmvNRhHCSiVEtQ.jpeg
El 27 de mayo de 2005 llegó por primera vez a Argentina, al menos de manera pública, el famoso hacker Kevin Mitnick, ya reconvertido en…
Continue reading on Ingeniería Social »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hacking A Home Network
https://cdn-images-1.medium.com/max/800/1*YBjkT97z8ehWmubbiFWquA.jpeg
Hacking into a home network is a simple task if someone has the proper tools and understanding of how to use them.
Continue reading on Medium »
Hacking A Home Network
https://cdn-images-1.medium.com/max/800/1*YBjkT97z8ehWmubbiFWquA.jpeg
Hacking into a home network is a simple task if someone has the proper tools and understanding of how to use them.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
InsurAce.io Biweekly Updates (Aug 09 — Aug 22)
https://cdn-images-1.medium.com/max/1600/0*LRVwS7ljqU0QvwLC
Find out what we have achieved during the past 2 weeks!
Continue reading on InsurAce Blog »
InsurAce.io Biweekly Updates (Aug 09 — Aug 22)
https://cdn-images-1.medium.com/max/1600/0*LRVwS7ljqU0QvwLC
Find out what we have achieved during the past 2 weeks!
Continue reading on InsurAce Blog »
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
PSA, Razer Synapse zero-day local privilege escalation (admin rights) in Windows 10 or 11 due to USB mouse installer
https://external-preview.redd.it/TkAa3mcDalzePPNuMVLVnVV2SJb7J9Ddr4UCc5XQK8I.jpg?width=640&crop=smart&auto=webp&s=d181c573474bfd5e4b1337b6c642b70daf51213b submitted by /u/daChazmanagerie
[link] [comments]
PSA, Razer Synapse zero-day local privilege escalation (admin rights) in Windows 10 or 11 due to USB mouse installer
https://external-preview.redd.it/TkAa3mcDalzePPNuMVLVnVV2SJb7J9Ddr4UCc5XQK8I.jpg?width=640&crop=smart&auto=webp&s=d181c573474bfd5e4b1337b6c642b70daf51213b submitted by /u/daChazmanagerie
[link] [comments]