PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-09 14:11:29 +00:00
Code Issues Projects Releases Wiki Activity

Another update for an Issue #352 and couple of fixes

Browse Source
This commit is contained in:
Miroslav Stampar
2013-03-13 21:57:09 +01:00
parent b35122a42c
commit 4cb378ce3e
38 changed files with 127 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
tamper/ifnull2ifisnull.py
View File

@@ -16,10 +16,6 @@ def tamper(payload, **kwargs):
"""
Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)'
Example:
* Input: IFNULL(1, 2)
* Output: IF(ISNULL(1), 2, 1)
Requirement:
* MySQL
* SQLite (possibly)
@@ -31,6 +27,9 @@ def tamper(payload, **kwargs):
Notes:
* Useful to bypass very weak and bespoke web application firewalls
that filter the IFNULL() function
>>> tamper('IFNULL(1, 2)')
'IF(ISNULL(1),2,1)'
"""
if payload and payload.find("IFNULL") > -1:
@@ -55,7 +54,7 @@ def tamper(payload, **kwargs):
if comma and end:
_ = payload[index + len("IFNULL("):comma]
__ = payload[comma + 1:end]
__ = payload[comma + 1:end].lstrip()
newVal = "IF(ISNULL(%s),%s,%s)" % (_, __, _)
payload = payload[:index] + newVal + payload[end + 1:]
else: