CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-30 14:11:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Refresh of tamper docu

Browse source
This commit is contained in:
Miroslav Štampar 2026-08-14 23:21:00 +02:00
parent 319910ccd8
commit 6770b2847b
18 changed files with 144 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.8.34"
VERSION = "1.10.8.35"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

14
tamper/between.py
View file

@ -19,16 +19,18 @@ def tamper(payload, **kwargs):
Replaces the greater-than operator (>) with NOT BETWEEN 0 AND # and the equal sign (=) with BETWEEN # AND #
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass weak and bespoke web application firewalls that
filter the greater than character
* The BETWEEN clause is SQL standard. Hence, this tamper script
should work against all (?) databases
* The BETWEEN clause is SQL standard, and the rewrite was confirmed
to run unchanged on every engine listed above
>>> tamper('1 AND A > B--')
'1 AND A NOT BETWEEN 0 AND B--'

12
tamper/commalesslimit.py
View file

@ -23,9 +23,19 @@ def tamper(payload, **kwargs):
Requirement:
* MySQL
* MariaDB
* SQLite
Tested against:
* MySQL 5.0 and 5.5
* MySQL 8.4.9
* MariaDB 11.8.8
* SQLite 3.45.1
Notes:
* Applicability is set by the 'LIMIT M, N' input form, which only MySQL,
MariaDB and SQLite accept. PostgreSQL rejects it (it takes solely the
'LIMIT N OFFSET M' form this script produces), so the script never has
anything to rewrite there
>>> tamper('LIMIT 2, 3')
'LIMIT 3 OFFSET 2'

10
tamper/commentbeforeparentheses.py
View file

@ -19,10 +19,12 @@ def tamper(payload, **kwargs):
Prepends (inline) comment before parentheses (e.g. ( -> /**/()
Tested against:
* Microsoft SQL Server
* MySQL
* Oracle
* PostgreSQL
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass web application firewalls that block usage

20
tamper/equaltolike.py
View file

@ -18,15 +18,27 @@ def tamper(payload, **kwargs):
"""
Replaces all occurrences of operator equal ('=') with 'LIKE' counterpart
Requirement:
* MySQL
* MariaDB
* SQLite
* Microsoft SQL Server
* Oracle
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* MySQL 8.4.9
* MariaDB 11.8.8
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass weak and bespoke web application firewalls that
filter the equal character ('=')
* The LIKE operator is SQL standard. Hence, this tamper script
should work against all (?) databases
* NOT usable against PostgreSQL, which refuses to compare a numeric
operand with LIKE (e.g. '1 LIKE 1' raises 'operator does not exist:
integer ~~ integer'), unlike the engines listed above which coerce
the operands to text
>>> tamper('SELECT * FROM users WHERE id=1')
'SELECT * FROM users WHERE id LIKE 1'

20
tamper/greatest.py
View file

@ -18,16 +18,26 @@ def tamper(payload, **kwargs):
"""
Replaces greater than operator ('>') with 'GREATEST' counterpart
Requirement:
* MySQL
* MariaDB
* PostgreSQL
* Microsoft SQL Server >= 2022
* Oracle
Tested against:
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass weak and bespoke web application firewalls that
filter the greater than character
* The GREATEST clause is a widespread SQL command. Hence, this
tamper script should work against majority of databases
* NOT usable against SQLite, which has no GREATEST() (it overloads
MAX() for the multi-argument case instead). Microsoft SQL Server
only gained GREATEST() in 2022
>>> tamper('1 AND A > B')
'1 AND GREATEST(A,B+1)=A'

9
tamper/if2case.py
View file

@ -48,15 +48,18 @@ def tamper(payload, **kwargs):
Requirement:
* MySQL
* SQLite (possibly)
* SAP MaxDB (possibly)
* MariaDB
Tested against:
* MySQL 5.0 and 5.5
* MySQL 8.4.9
* MariaDB 11.8.8
Notes:
* Useful to bypass very weak and bespoke web application firewalls
that filter the IF() functions
* The CASE replacement itself is standard SQL and runs anywhere, but the
'IF(A, B, C)' input form is MySQL/MariaDB-only (SQLite, for one, has no
IF() function), so there is nothing to rewrite on other engines
>>> tamper('IF(1, 2, 3)')
'CASE WHEN (1) THEN (2) ELSE (3) END'

8
tamper/ifnull2casewhenisnull.py
View file

@ -19,15 +19,17 @@ def tamper(payload, **kwargs):
Requirement:
* MySQL
* SQLite (possibly)
* SAP MaxDB (possibly)
* MariaDB
Tested against:
* MySQL 5.0 and 5.5
* MySQL 8.4.9
* MariaDB 11.8.8
Notes:
* Useful to bypass very weak and bespoke web application firewalls
that filter the IFNULL() functions
* NOT usable against SQLite, despite it having IFNULL(): the replacement
needs ISNULL(), which SQLite does not provide
>>> tamper('IFNULL(1, 2)')
'CASE WHEN ISNULL(1) THEN (2) ELSE (1) END'

8
tamper/ifnull2ifisnull.py
View file

@ -19,15 +19,17 @@ def tamper(payload, **kwargs):
Requirement:
* MySQL
* SQLite (possibly)
* SAP MaxDB (possibly)
* MariaDB
Tested against:
* MySQL 5.0 and 5.5
* MySQL 8.4.9
* MariaDB 11.8.8
Notes:
* Useful to bypass very weak and bespoke web application firewalls
that filter the IFNULL() function
* NOT usable against SQLite, despite it having IFNULL(): the replacement
needs both IF() and ISNULL(), neither of which SQLite provides
>>> tamper('IFNULL(1, 2)')
'IF(ISNULL(1),2,1)'

20
tamper/least.py
View file

@ -18,16 +18,26 @@ def tamper(payload, **kwargs):
"""
Replaces greater than operator ('>') with 'LEAST' counterpart
Requirement:
* MySQL
* MariaDB
* PostgreSQL
* Microsoft SQL Server >= 2022
* Oracle
Tested against:
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass weak and bespoke web application firewalls that
filter the greater than character
* The LEAST clause is a widespread SQL command. Hence, this
tamper script should work against majority of databases
* NOT usable against SQLite, which has no LEAST() (it overloads
MIN() for the multi-argument case instead). Microsoft SQL Server
only gained LEAST() in 2022
>>> tamper('1 AND A > B')
'1 AND LEAST(A,B+1)=B+1'

10
tamper/lowercase.py
View file

@ -20,10 +20,12 @@ def tamper(payload, **kwargs):
Replaces each keyword character with lower case value (e.g. SELECT -> select)
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass very weak and bespoke web application firewalls

8
tamper/multiplespaces.py
View file

@ -21,6 +21,14 @@ def tamper(payload, **kwargs):
"""
Adds multiple spaces (' ') around SQL keywords
Tested against:
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass very weak and bespoke web application firewalls
that has poorly written permissive regular expressions

13
tamper/randomcase.py
View file

@ -22,16 +22,17 @@ def tamper(payload, **kwargs):
Replaces each keyword character with random case value (e.g. SELECT -> SEleCt)
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
* SQLite 3
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass very weak and bespoke web application firewalls
that has poorly written permissive regular expressions
* This tamper script should work against all (?) databases
* Keyword case is insignificant on every engine listed above
>>> import random
>>> random.seed(0)

10
tamper/sign.py
View file

@ -19,10 +19,12 @@ def tamper(payload, **kwargs):
Replaces greater than operator ('>') with 'SIGN' counterpart (e.g. SIGN((A)-(B))=1)
Tested against:
* MySQL 5
* Oracle 11g
* PostgreSQL 9
* Microsoft SQL Server 2012
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass filtering of comparison operators altogether (>, <,

10
tamper/space2comment.py
View file

@ -18,10 +18,12 @@ def tamper(payload, **kwargs):
Replaces space character (' ') with comments '/**/'
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass weak and bespoke web application firewalls

9
tamper/space2morecomment.py
View file

@ -18,10 +18,17 @@ def tamper(payload, **kwargs):
Replaces (MySQL) instances of space character (' ') with comments '/**_**/'
Tested against:
* MySQL 5.0 and 5.5
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass weak and bespoke web application firewalls
* Despite the script's name, '/**_**/' is a valid comment on every engine
listed above, not just MySQL
>>> tamper('SELECT id FROM users')
'SELECT/**_**/id/**_**/FROM/**_**/users'

8
tamper/unionalltounion.py
View file

@ -18,6 +18,14 @@ def tamper(payload, **kwargs):
"""
Replaces instances of UNION ALL SELECT with UNION SELECT counterpart
Tested against:
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
>>> tamper('-1 UNION ALL SELECT')
'-1 UNION SELECT'
"""

12
tamper/uppercase.py
View file

@ -20,15 +20,17 @@ def tamper(payload, **kwargs):
Replaces each keyword character with upper case value (e.g. select -> SELECT)
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
* MySQL 8.4.9
* MariaDB 11.8.8
* PostgreSQL 16.11
* SQLite 3.45.1
* Microsoft SQL Server 2022
* Oracle 23ai
Notes:
* Useful to bypass very weak and bespoke web application firewalls
that has poorly written permissive regular expressions
* This tamper script should work against all (?) databases
* Keyword case is insignificant on every engine listed above
>>> tamper('insert')
'INSERT'