CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-28 12:42:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Minor patches to tamper scripts

Browse source
This commit is contained in:
Miroslav Štampar 2026-06-04 20:06:07 +02:00
parent 2c356ed22a
commit 2f4ff0d430
5 changed files with 53 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

28
tamper/ifnull2ifisnull.py
View file

@ -33,25 +33,29 @@ def tamper(payload, **kwargs):
'IF(ISNULL(1),2,1)'
"""
if payload and payload.find("IFNULL") > -1:
if payload and payload.find("IFNULL(") > -1:
while payload.find("IFNULL(") > -1:
index = payload.find("IFNULL(")
depth = 1
comma, end = None, None
quote, doublequote = False, False
for i in xrange(index + len("IFNULL("), len(payload)):
if depth == 1 and payload[i] == ',':
comma = i
if payload[i] == '\'' and (i == 0 or payload[i - 1] != '\\'):
quote = not quote
elif payload[i] == '"' and (i == 0 or payload[i - 1] != '\\'):
doublequote = not doublequote
elif depth == 1 and payload[i] == ')':
end = i
break
elif payload[i] == '(':
depth += 1
elif payload[i] == ')':
depth -= 1
if not quote and not doublequote:
if depth == 1 and payload[i] == ',':
comma = i
elif depth == 1 and payload[i] == ')':
end = i
break
elif payload[i] == '(':
depth += 1
elif payload[i] == ')':
depth -= 1
if comma and end:
_ = payload[index + len("IFNULL("):comma]