sqlmap/tamper/dunion.py

35 lines
906 B
Python
Raw Permalink Normal View History

2020-07-27 14:49:48 +03:00
#!/usr/bin/env python
"""
2022-01-03 13:30:34 +03:00
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
2020-07-27 14:49:48 +03:00
See the file 'LICENSE' for copying permission
"""
2020-08-04 11:34:18 +03:00
import os
2020-07-27 14:49:48 +03:00
import re
2020-08-04 11:34:18 +03:00
from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
2020-07-27 14:49:48 +03:00
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGHEST
def dependencies():
2020-08-04 11:34:18 +03:00
singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.ORACLE))
2020-07-27 14:49:48 +03:00
def tamper(payload, **kwargs):
"""
Replaces instances of <int> UNION with <int>DUNION
Requirement:
* Oracle
Notes:
* Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf
>>> tamper('1 UNION ALL SELECT')
'1DUNION ALL SELECT'
"""
2020-11-10 01:02:48 +03:00
return re.sub(r"(?i)(\d+)\s+(UNION )", r"\g<1>D\g<2>", payload) if payload else payload