PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-25 17:09:02 +00:00
Code Issues Projects Releases Wiki Activity

Another update for an Issue #352 and couple of fixes

Browse Source
This commit is contained in:
Miroslav Stampar
2013-03-13 21:57:09 +01:00
parent b35122a42c
commit 4cb378ce3e
38 changed files with 127 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
tamper/bluecoat.py
View File

@@ -19,10 +19,6 @@ def tamper(payload, **kwargs):
Replaces space character after SQL statement with a valid random blank character.
Afterwards replace character = with LIKE operator
Example:
* Input: SELECT id FROM users where id = 1
* Output: SELECT%09id FROM users where id LIKE 1
Requirement:
* Blue Coat SGOS with WAF activated as documented in
https://kb.bluecoat.com/index?page=content&id=FAQ2147
@@ -32,12 +28,15 @@ def tamper(payload, **kwargs):
Notes:
* Useful to bypass Blue Coat's recommended WAF rule configuration
>>> tamper('SELECT id FROM users where id = 1')
'SELECT%09id FROM users where id LIKE 1'
"""
retVal = payload
if payload:
retVal = re.sub(r"(?i)(SELECT|UPDATE|INSERT|DELETE)\s+", r"\g<1>\t", payload)
retVal = re.sub(r"(?i)(SELECT|UPDATE|INSERT|DELETE)\s+", r"\g<1>%09", payload)
retVal = re.sub(r"\s*=\s*", " LIKE ", retVal)
return retVal