CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-10-20 18:54:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Minor fix of space2 tamper scripts

Browse source
This commit is contained in:
Miroslav Štampar 2026-06-04 20:00:38 +02:00
parent f564db0d56
commit 2c356ed22a
7 changed files with 85 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

22
tamper/space2dash.py
View file

@ -34,13 +34,23 @@ def tamper(payload, **kwargs):
retVal = ""
if payload:
quote, doublequote = False, False
for i in xrange(len(payload)):
if payload[i].isspace():
randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12)))
retVal += "--%s%%0A" % randomStr
elif payload[i] == '#' or payload[i:i + 3] == '-- ':
retVal += payload[i:]
break
if payload[i] == '\'' and (i == 0 or payload[i - 1] != '\\'):
quote = not quote
elif payload[i] == '"' and (i == 0 or payload[i - 1] != '\\'):
doublequote = not doublequote
if not quote and not doublequote:
if payload[i].isspace():
randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12)))
retVal += "--%s%%0A" % randomStr
elif payload[i] == '#' or payload[i:i + 3] == '-- ':
retVal += payload[i:]
break
else:
retVal += payload[i]
else:
retVal += payload[i]

22
tamper/space2hash.py
View file

@ -42,13 +42,23 @@ def tamper(payload, **kwargs):
retVal = ""
if payload:
quote, doublequote = False, False
for i in xrange(len(payload)):
if payload[i].isspace():
randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12)))
retVal += "%%23%s%%0A" % randomStr
elif payload[i] == '#' or payload[i:i + 3] == '-- ':
retVal += payload[i:]
break
if payload[i] == '\'' and (i == 0 or payload[i - 1] != '\\'):
quote = not quote
elif payload[i] == '"' and (i == 0 or payload[i - 1] != '\\'):
doublequote = not doublequote
if not quote and not doublequote:
if payload[i].isspace():
randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12)))
retVal += "%%23%s%%0A" % randomStr
elif payload[i] == '#' or payload[i:i + 3] == '-- ':
retVal += payload[i:]
break
else:
retVal += payload[i]
else:
retVal += payload[i]

22
tamper/space2morehash.py
View file

@ -56,13 +56,23 @@ def tamper(payload, **kwargs):
if payload:
payload = re.sub(r"(?:^|(?<=\W))(?P<word>[A-Za-z_]+)(?=[^\w(]|\Z)", process, payload)
quote, doublequote = False, False
for i in xrange(len(payload)):
if payload[i].isspace():
randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12)))
retVal += "%%23%s%%0A" % randomStr
elif payload[i] == '#' or payload[i:i + 3] == '-- ':
retVal += payload[i:]
break
if payload[i] == '\'' and (i == 0 or payload[i - 1] != '\\'):
quote = not quote
elif payload[i] == '"' and (i == 0 or payload[i - 1] != '\\'):
doublequote = not doublequote
if not quote and not doublequote:
if payload[i].isspace():
randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12)))
retVal += "%%23%s%%0A" % randomStr
elif payload[i] == '#' or payload[i:i + 3] == '-- ':
retVal += payload[i:]
break
else:
retVal += payload[i]
else:
retVal += payload[i]

20
tamper/space2mssqlhash.py
View file

@ -28,12 +28,22 @@ def tamper(payload, **kwargs):
retVal = ""
if payload:
quote, doublequote = False, False
for i in xrange(len(payload)):
if payload[i].isspace():
retVal += "%23%0A"
elif payload[i] == '#' or payload[i:i + 3] == '-- ':
retVal += payload[i:]
break
if payload[i] == '\'' and (i == 0 or payload[i - 1] != '\\'):
quote = not quote
elif payload[i] == '"' and (i == 0 or payload[i - 1] != '\\'):
doublequote = not doublequote
if not quote and not doublequote:
if payload[i].isspace():
retVal += "%23%0A"
elif payload[i] == '#' or payload[i:i + 3] == '-- ':
retVal += payload[i:]
break
else:
retVal += payload[i]
else:
retVal += payload[i]

20
tamper/space2mysqldash.py
View file

@ -35,12 +35,22 @@ def tamper(payload, **kwargs):
retVal = ""
if payload:
quote, doublequote = False, False
for i in xrange(len(payload)):
if payload[i].isspace():
retVal += "--%0A"
elif payload[i] == '#' or payload[i:i + 3] == '-- ':
retVal += payload[i:]
break
if payload[i] == '\'' and (i == 0 or payload[i - 1] != '\\'):
quote = not quote
elif payload[i] == '"' and (i == 0 or payload[i - 1] != '\\'):
doublequote = not doublequote
if not quote and not doublequote:
if payload[i].isspace():
retVal += "--%0A"
elif payload[i] == '#' or payload[i:i + 3] == '-- ':
retVal += payload[i:]
break
else:
retVal += payload[i]
else:
retVal += payload[i]