WooYun.org

#!/usr/bin/env python """ Copyright (c) 2006-2015 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGH def tamper(payload, **kwargs): """ Appends 'sp_password' to the end of the payload for automatic obfuscation from DBMS logs Requirement: * MSSQL Notes: * Appending sp_password to the end of the query will hide it from T-SQL logs as a security measure * Reference: http://websec.ca/kb/sql_injection >>> tamper('1 AND 9227=9227-- ') '1 AND 9227=9227-- sp_password' """ return payload.replace('AND ','/*!AND*/').replace('UNION ','/*!UNION*/').replace('ORDER ','/*!ORDER*/').replace('BY ','/*!BY*/').replace('SELECT ','/*!SELECT*/').replace('FROM ','/*!FROM*/').replace('WHERE ','/*!WHERE*/').replace('WHEN ','/*!WHEN*/').replace('ELSE ','/*!ELSE*/').replace('THEN ','/*!THEN*/').replace('END ','/*!END*/').replace('IF ','/*!IF*/').replace('IFNULL','/*!IFNULL*/').replace('AS ','/*!AS*/').replace('LIMIT','/*!LIMIT*/').replace('IN ','/*!IN*/')