sqlmap/tamper/space2randomblank.py

68 lines
1.6 KiB
Python
Raw Permalink Normal View History

2019-05-08 13:47:52 +03:00
#!/usr/bin/env python
"""
2022-01-03 13:30:34 +03:00
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
2017-10-11 15:50:46 +03:00
See the file 'LICENSE' for copying permission
"""
import random
2019-03-28 18:04:38 +03:00
from lib.core.compat import xrange
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOW
def dependencies():
pass
2012-12-03 17:27:01 +04:00
def tamper(payload, **kwargs):
"""
2018-07-31 03:18:33 +03:00
Replaces space character (' ') with a random blank character from a valid set of alternate characters
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass several web application firewalls
>>> random.seed(0)
>>> tamper('SELECT id FROM users')
2019-05-03 14:20:15 +03:00
'SELECT%0Did%0CFROM%0Ausers'
"""
# ASCII table:
# TAB 09 horizontal TAB
# LF 0A new line
# FF 0C new page
# CR 0D carriage return
2012-04-15 21:17:30 +04:00
blanks = ("%09", "%0A", "%0C", "%0D")
2011-04-04 12:18:26 +04:00
retVal = payload
2011-04-04 12:18:26 +04:00
if payload:
retVal = ""
quote, doublequote, firstspace = False, False, False
2011-04-04 12:18:26 +04:00
for i in xrange(len(payload)):
if not firstspace:
2011-04-04 12:18:26 +04:00
if payload[i].isspace():
firstspace = True
retVal += random.choice(blanks)
continue
2011-04-04 12:18:26 +04:00
elif payload[i] == '\'':
quote = not quote
2011-04-04 12:18:26 +04:00
elif payload[i] == '"':
doublequote = not doublequote
2012-04-15 21:17:30 +04:00
elif payload[i] == ' ' and not doublequote and not quote:
retVal += random.choice(blanks)
continue
2011-04-04 12:18:26 +04:00
retVal += payload[i]
return retVal