PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-06 12:41:30 +00:00
Code Issues Projects Releases Wiki Activity

First commit related to the #3108

Browse Source
This commit is contained in:
Miroslav Stampar
2018-07-31 01:17:11 +02:00
parent cef416559a
commit f0e4c20004
32 changed files with 72 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
tamper/charencode.py
View File

@@ -16,8 +16,7 @@ def dependencies():
def tamper(payload, **kwargs):
"""
Url-encodes all characters in a given payload (not processing already
encoded)
URL-encodes all characters in a given payload (not processing already encoded)
Tested against:
* Microsoft SQL Server 2005
@@ -26,10 +25,8 @@ def tamper(payload, **kwargs):
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass very weak web application firewalls that do not
url-decode the request before processing it through their ruleset
* The web server will anyway pass the url-decoded version behind,
hence it should work against any DBMS
* Useful to bypass very weak web application firewalls that do not url-decode the request before processing it through their ruleset
* The web server will anyway pass the url-decoded version behind, hence it should work against any DBMS
>>> tamper('SELECT FIELD FROM%20TABLE')
'%53%45%4C%45%43%54%20%46%49%45%4C%44%20%46%52%4F%4D%20%54%41%42%4C%45'