sqlmap/tamper/space2randomblank.py

68 lines
1.6 KiB
Python
Raw Normal View History

#!/usr/bin/env python
"""
2013-01-18 18:07:51 +04:00
Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""
import random
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOW
def dependencies():
pass
2012-12-03 17:27:01 +04:00
def tamper(payload, **kwargs):
"""
Replaces space character (' ') with a random blank character from a
valid set of alternate characters
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass several web application firewalls
>>> random.seed(0)
>>> tamper('SELECT id FROM users')
'SELECT%0Did%0DFROM%0Ausers'
"""
# ASCII table:
# TAB 09 horizontal TAB
# LF 0A new line
# FF 0C new page
# CR 0D carriage return
2012-04-15 21:17:30 +04:00
blanks = ("%09", "%0A", "%0C", "%0D")
2011-04-04 12:18:26 +04:00
retVal = payload
2011-04-04 12:18:26 +04:00
if payload:
retVal = ""
quote, doublequote, firstspace = False, False, False
2011-04-04 12:18:26 +04:00
for i in xrange(len(payload)):
if not firstspace:
2011-04-04 12:18:26 +04:00
if payload[i].isspace():
firstspace = True
retVal += random.choice(blanks)
continue
2011-04-04 12:18:26 +04:00
elif payload[i] == '\'':
quote = not quote
2011-04-04 12:18:26 +04:00
elif payload[i] == '"':
doublequote = not doublequote
2012-04-15 21:17:30 +04:00
elif payload[i] == ' ' and not doublequote and not quote:
retVal += random.choice(blanks)
continue
2011-04-04 12:18:26 +04:00
retVal += payload[i]
return retVal