sqlmap/tamper/lowercase.py at master · sql9/sqlmap · GitHub

46 lines (33 loc) · 1.02 KB

#!/usr/bin/env python

"""

See the file 'doc/COPYING' for copying permission

"""

import re

from lib.core.data import kb

from lib.core.enums import PRIORITY

__priority__ = PRIORITY.NORMAL

def dependencies():

pass

def tamper(payload, **kwargs):

"""

Replaces each keyword character with lower case value

Tested against:

* Microsoft SQL Server 2005

* MySQL 4, 5.0 and 5.5

* Oracle 10g

* PostgreSQL 8.3, 8.4, 9.0

Notes:

* Useful to bypass very weak and bespoke web application firewalls

that has poorly written permissive regular expressions

* This tamper script should work against all (?) databases

>>> tamper('INSERT')

'insert'

"""

retVal = payload

if payload:

for match in re.finditer(r"[A-Za-z_]+", retVal):

word = match.group()

if word.upper() in kb.keywords:

retVal = retVal.replace(word, word.lower())

return retVal

Expand file tree