sqlmapproject
Support to run a query as another DB user
When stacked queries is supported use OPENROWSET (MSSQL) and dblink() (PostgreSQL) to run a statement as a different user (e.g. higher privileged user for instance after a password cracking attack).
The same library code can be used in ticket #31.
First rough implementation in commit 66979270983a9659827d86b30fedfc5b6508e5e3 (forgot to reference this issue in the commit message)
As of PostgreSQL 9.1, dblink() function is still in the contrib folder and not packaged by default:
[...] modules that can be found in the contrib directory of the PostgreSQL distribution. These include porting tools, analysis utilities, and plug-in features that are not part of the core PostgreSQL system [...]
It requires the DBA to manually compile PostgreSQL and run the dblink.sql statement to create the function before being usable.
Hence, shall we support it despite there're very little chances we ever find it available? Comments are welcome.
Currently Google says 135.000 results for search query: dblink postgresql. That doesn't say anything that if the task is not too hard to be accomplished it wouldn't be something of total lack of practical usage.
