PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-06 12:41:30 +00:00
Code Issues Projects Releases Wiki Activity

Minor bug fixes, code refactoring and enhanced --tamper functionality

Browse Source
This commit is contained in:
Bernardo Damele
2010-10-16 21:33:15 +00:00
parent 5c3d21065a
commit 2dae934a2b
9 changed files with 68 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
tamper/space2comment.py
View File

@@ -7,15 +7,15 @@ Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
See the file 'doc/COPYING' for copying permission
"""
import re
from lib.core.convert import urldecode
from lib.core.convert import urlencode
"""
' ' -> /**/ (e.g., SELECT id FROM users->SELECT/**/id/**/FROM users)
"""
def tamper(place, value):
"""
Replaces ' ' with '/**/'
Example: 'SELECT id FROM users' becomes 'SELECT/**/id/**/FROM users'
"""
retVal = value
if value:
@@ -23,7 +23,7 @@ def tamper(place, value):
value = urldecode(value)
retVal = ""
qoute, doublequote, firstspace = False, False, False
quote, doublequote, firstspace = False, False, False
for i in xrange(len(value)):
if not firstspace:
@@ -33,12 +33,12 @@ def tamper(place, value):
continue
elif value[i] == '\'':
qoute = not qoute
quote = not quote
elif value[i] == '"':
doublequote = not doublequote
elif value[i]==" " and not doublequote and not qoute:
elif value[i]==" " and not doublequote and not quote:
retVal += "/**/"
continue