sqlmap/tamper/space2plus.py at master · baixiangcpp/sqlmap · GitHub

History

53 lines (38 loc) · 1.23 KB

Raw

#!/usr/bin/env python

"""

See the file 'doc/COPYING' for copying permission

"""

from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():

pass

def tamper(payload, **kwargs):

"""

Replaces space character (' ') with plus ('+')

Notes:

* Is this any useful? The plus get's url-encoded by sqlmap engine

invalidating the query afterwards

* This tamper script works against all databases

>>> tamper('SELECT id FROM users')

'SELECT+id+FROM+users'

"""

retVal = payload

if payload:

retVal = ""

quote, doublequote, firstspace = False, False, False

for i in xrange(len(payload)):

if not firstspace:

if payload[i].isspace():

firstspace = True

retVal += "+"

continue

elif payload[i] == '\'':

quote = not quote

elif payload[i] == '"':

doublequote = not doublequote

elif payload[i] == " " and not doublequote and not quote:

retVal += "+"

continue

retVal += payload[i]

return retVal

sqlmap/tamper/space2plus.py at master · baixiangcpp/sqlmap · GitHub

Expand file tree

Breadcrumbs

space2plus.py

Latest commit

History

Breadcrumbs

space2plus.py

File metadata and controls