Click here to load reader

sqlmap-tamper-scripts sqlmap tamper 详解 sqlmap-tamper-scripts sqlmap tamper 详解 sqlmap-tamper-scripts sqlmap tamper 详解 首页 首页 » » 原创作品 原创作品 » sqlmap-tamper-scripts

  • View
    3

  • Download
    0

Embed Size (px)

Text of sqlmap-tamper-scripts sqlmap tamper 详解 sqlmap-tamper-scripts sqlmap tamper 详解...

  • 评论↓评论↓ 隐藏隐藏 分享分享 关灯关灯 小小 中中 大大

    sqlmap-tamper-scripts sqlmap tamper 详详解解sqlmap-tamper-scripts sqlmap tamper 详详解解

    首页首页 » » 原创作品原创作品 » sqlmap-tamper-scripts sqlmap tamper 详解 » sqlmap-tamper-scripts sqlmap tamper 详解

    When using SQLMap Tamper scripts while doing a pentest can be a bit When using SQLMap Tamper scripts while doing a pentest can be a bit confusing and a lot of work to figureconfusing and a lot of work to figure

    out which scripts you need to use out which scripts you need to use and when to use them. I have an upcoming pentest I need to perform andand when to use them. I have an upcoming pentest I need to perform and

    figured this is the perfect time to organize �all of this.figured this is the perfect time to organize �all of this.

    First of all, not all scripts are created equal. Some work for First of all, not all scripts are created equal. Some work for general run-of-the mill sql injection attacks andgeneral run-of-the mill sql injection attacks and

    others are for others are for specific databases. Some are not actually sure if it works on all specific databases. Some are not actually sure if it works on all databases and some have onlydatabases and some have only

    been officially tested against older been officially tested against older versions of database applications. This is the very definition of hit versions of database applications. This is the very definition of hit and miss.and miss.

    I reviewed each tamper script and tried to place them in boxes. If I reviewed each tamper script and tried to place them in boxes. If you have feedback on any of these boxesyou have feedback on any of these boxes

    PLEASE don’t be shy! Let me know PLEASE don’t be shy! Let me know in the comment section. I want this to be a good resource and your help in the comment section. I want this to be a good resource and your help wouldwould

    be greatly appreciated.be greatly appreciated.

    The General Scripts section contains both non-specific database The General Scripts section contains both non-specific database exploits as well as those that cover a wideexploits as well as those that cover a wide

    range of databases. In my range of databases. In my thoughts, this would be a good start script box to use as an initial hit thoughts, this would be a good start script box to use as an initial hit on an application.on an application.

    Again, feedback appreciated.Again, feedback appreciated.

    I am going to include the syntax to run each section as well as one I am going to include the syntax to run each section as well as one to run every script. SQLMap will organizeto run every script. SQLMap will organize

    them automatically. However, I them automatically. However, I captured traffic from running all scripts and it didn’t look familiar captured traffic from running all scripts and it didn’t look familiar at all. �notat all. �not

    sure if it is a good idea to do this or not. Feedback sure if it is a good idea to do this or not. Feedback welcome!welcome!

    Jump toJump to

    generalgeneral

    Microsoft-AccessMicrosoft-Access

    mssqlmssql

    mysqlmysql

    oracleoracle

    postresqlpostresql

    sapsap

    sqlitesqlite

    --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,ch--tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,ch arencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecuritarencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurit yversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcommenyversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcommen ts,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,spats,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,spa ce2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionce2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,version edkeywords,versionedmorekeywordsedkeywords,versionedmorekeywords

    General ScriptsGeneral Scripts --tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeen--tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeen code,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,scode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,s pace2comment,space2plus,space2randomblank,unionalltounion,unmagicquotespace2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes

    apostrophemaskapostrophemask

    Replaces apostrophe character with its UTF-8 full width counterpartReplaces apostrophe character with its UTF-8 full width counterpart

    apostrophenullencodeapostrophenullencode

    Replaces apostrophe character with its illegal double unicode counterpartReplaces apostrophe character with its illegal double unicode counterpart

    代码审计(72)代码审计(72) 原创作品(120)原创作品(120)

    漏洞收集(40)漏洞收集(40) 渗透测试(238)渗透测试(238)

    渗透编程(21)渗透编程(21) 神器下载(87)神器下载(87)

    学员作品(28)学员作品(28) 业界见闻(50)业界见闻(50)

    Mrxn's blogMrxn's blog 落雪依然's Blog落雪依然's Blog

    暗月培暗月培训训服服务务(广告)(广告)

    1 暗月内部安全培训规定和费用说明暗月内部安全培训规定和费用说明

    2 暗月PHP代码审计系列教程暗月PHP代码审计系列教程

    3 暗月第四季课程暗月第四季课程

    4 社工库系列教程社工库系列教程

    5 暗月安全培训服务第一二季度暗月安全培训服务第一二季度

    最新日志最新日志

    1 Session fixationSession fixation

    2 ubuntu16.04安装met...ubuntu16.04安装met...

    3 theharvester 下载theharvester 下载

    4 被动式漏洞扫描系统GourdSc...被动式漏洞扫描系统GourdSc...

    5 渗透测试执行标准(PTES)渗透测试执行标准(PTES)

    热门热门日志日志

    1 (首发)dedecms 5.7 ...(首发)dedecms 5.7 ...

    2 社工库系列教程社工库系列教程

    3 暗月安全培训服务(渗透师、攻城师...暗月安全培训服务(渗透师、攻城师...

    4 利用腾讯微博获取QQ号利用腾讯微博获取QQ号

    5 soyun30社工数据库soyun30社工数据库

    6 DZ论坛最新注入漏洞利用工具(获...DZ论坛最新注入漏洞利用工具(获...

    7 学员渗透录六友情检测【毒一无二技...学员渗透录六友情检测【毒一无二技...

    8 安全暗月培训服务(代码审计师、漏...安全暗月培训服务(代码审计师、漏...

    随机日志随机日志

    1 另类的SQL注入方法另类的SQL注入方法

    2 Discuz! X 后台批量破解...Discuz! X 后台批量破解...

    3 学员渗透录二十三SQL Serv...学员渗透录二十三SQL Serv...

    4 价值万元黑帽就业内部教程泄露!价值万元黑帽就业内部教程泄露!

    5 wdcp虚拟主机管理系统注入利用...wdcp虚拟主机管理系统注入利用...

    6 险企网销泄信息1700万条 黑客...险企网销泄信息1700万条 黑客...

    7 新老版本安全狗拦截添加账户存在绕...新老版本安全狗拦截添加账户存在绕...

    8 暗月爆库鸡暗月爆库鸡

    分分类类

    链链接接

    ​ ​

    二千人交流群 二千人交流群 131634501131634501 [挤眼]加进来一起玩耍![挤眼]加进来一起玩耍!

    首首页页首首页页 代代码审计码审计代代码审计码审计 原原创创作品作品原原创创作品作品 渗透渗透测试测试渗透渗透测试测试 学学员员作品作品学学员员作品作品 神器下神器下载载神器下神器下载载 搜搜更健康搜搜更健康

    AprApr111120152015

    converted by Web2PDFConvert.com

    http://www.moonsec.com/ http://www.moonsec.com/rss.php http://www.moonsec.com/ http://www.moonsec.com/sort/1 http://www.moonsec.com/sort/2 http://www.moonsec.com/sort/4 http://www.moonsec.com/sort/12 http://www.moonsec.com/sort/11 http://www.moonsec.com/ http://www.moonsec.com/sort/2 javascript: javascript: javascript: javascript: javascript: javascript: javascript: http://blog.netinfiltration.com/2014/09/24/sqlmap-tamper-scripts/#general http://blog.netinfiltration.com/2014/09/24/sqlmap-tamper-scripts/#Microsoft-Access http://blog.netinfiltration.com/2014/09/24/sqlmap-tamper-scripts/#mssql http://blog.netinfiltration.com/2014/09/24/sqlmap-tamper-scripts/#mysql http://blog.netinfiltration.com/2014/09/24/sqlmap-tamper-scripts/#oracle http://blog.netinfiltration.com/2014/09/24/sqlmap-tamper-scripts/#postresql http://blog.netinfiltration.com/2014/09/24/sqlmap-tamper-scripts/#sap http://blog.netinfiltration.com/2014/09/24/sqlmap-tamper-scripts/#sqlite http://www.moonsec.com/post-529.html http://www.moonsec.com/post-224.html http://www.moonsec.com/post-425.html http://www.moonsec.com/post-199.html http://www.moonsec.com/post-164.html http://www.moonsec.co

Search related