mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2025-12-06 20:51:31 +00:00
Revamp of tamper scripts, now supporting dependencies() function as well. Improved a lot the docstring and retested all. Added a new one from Ahmad too.
This commit is contained in:
@@ -10,16 +10,26 @@ See the file 'doc/COPYING' for copying permission
|
||||
import random
|
||||
import re
|
||||
|
||||
from lib.core.common import randomRange
|
||||
from lib.core.data import kb
|
||||
from lib.core.enums import PRIORITY
|
||||
|
||||
__priority__ = PRIORITY.NORMAL
|
||||
|
||||
def dependencies():
|
||||
pass
|
||||
|
||||
def tamper(payload):
|
||||
"""
|
||||
Adding multiple spaces around SQL keywords
|
||||
Example: 'UNION SELECT' migth become ' UNION SELECT '
|
||||
Adds multiple spaces around SQL keywords
|
||||
|
||||
Example:
|
||||
* Input: UNION SELECT
|
||||
* Output: UNION SELECT
|
||||
|
||||
Notes:
|
||||
* Useful to bypass very weak and bespoke web application firewalls
|
||||
that has poorly written permissive regular expressions
|
||||
|
||||
Reference: https://www.owasp.org/images/7/74/Advanced_SQL_Injection.ppt
|
||||
"""
|
||||
|
||||
|
||||
Reference in New Issue
Block a user