1#!/usr/bin/env python 2 3""" 4Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/) 5See the file 'LICENSE' for copying permission 6""" 7 8import os 9import random 10 11from lib.core.common import singleTimeWarnMessage 12from lib.core.compat import xrange 13from lib.core.enums import DBMS 14from lib.core.enums import PRIORITY 15 16__priority__ = PRIORITY.LOW 17 18def dependencies(): 19 singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) 20 21def tamper(payload, **kwargs): 22 """ 23 Replaces (MySQL) instances of space character (' ') with a random blank character from a valid set of alternate characters 24 25 Requirement: 26 * MySQL 27 28 Tested against: 29 * MySQL 5.1 30 31 Notes: 32 * Useful to bypass several web application firewalls 33 34 >>> random.seed(0) 35 >>> tamper('SELECT id FROM users') 36 'SELECT%A0id%0CFROM%0Dusers' 37 """ 38 39 # ASCII table: 40 # TAB 09 horizontal TAB 41 # LF 0A new line 42 # FF 0C new page 43 # CR 0D carriage return 44 # VT 0B vertical TAB (MySQL and Microsoft SQL Server only) 45 # A0 non-breaking space 46 blanks = ('%09', '%0A', '%0C', '%0D', '%0B', '%A0') 47 retVal = payload 48 49 if payload: 50 retVal = "" 51 quote, doublequote, firstspace = False, False, False 52 53 for i in xrange(len(payload)): 54 if not firstspace: 55 if payload[i].isspace(): 56 firstspace = True 57 retVal += random.choice(blanks) 58 continue 59 60 elif payload[i] == '\'': 61 quote = not quote 62 63 elif payload[i] == '"': 64 doublequote = not doublequote 65 66 elif payload[i] == " " and not doublequote and not quote: 67 retVal += random.choice(blanks) 68 continue 69 70 retVal += payload[i] 71 72 return retVal 73