#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from lib.core.common import singleTimeWarnMessage from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGH def dependencies(): pass def tamper(payload, **kwargs): """ Replaces instances like 'LIMIT M, N' with 'LIMIT N OFFSET M' Requirement: * MySQL Tested against: * MySQL 5.0 and 5.5 >>> tamper('LIMIT 2, 3') 'LIMIT 3 OFFSET 2' """ retVal = payload match = re.search(r"(?i)LIMIT\s*(\d+),\s*(\d+)", payload or "") if match: retVal = retVal.replace(match.group(0), "LIMIT %s OFFSET %s" % (match.group(2), match.group(1))) return retVal